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A Purpose: 

Th* purpose of this policy is to promulgate the OwnreiterrorivTi Aster 0</*ac (ctpgj 


fl. Policy statement: 

b i. All Federal Bureau of Investigation fFBI) employees, rieterten, contractors, t*» fares merrfref*. 
and others responsible for performing count ert on prism operations rn furtherance gf m* -r. •s^cn 5/ the 
FBI must comply with the policies and procedures contained *r tne CTPG, wh<h conMt »4 msr. die 
laws, rules, and regulations governing FBI investigations r operations, program 5 and activ*tjes See the 
CTPG for these policies and procedures. 

B, 2 , Any revisions, amendments, or updates to this PG must he coordinated f*vw*gh me Inters 
Office (IPO) and the Counterterrorism Division (CTDJi diyiswm policy crffksr fDPO) and oc'ier arc 
stakeholders (as determined by IPO and the proponent division) Resulting changes must then oe 
approved by the CTD assistant director (AD* and the Narional Security Branch Skerj&ve assent 
director (FAD), as appropriate 


9. Scope: 

This directive and the policies and procedures contained in the CTPG aotHy to a er^pspyees 
detailees, contractors, task force members, and others respo^s b*e far perfprrTvng 
operations. 


10. Proponent: 

Counterterrorism Division 


1 1. Roles and Responsibilities: 
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11 SupwspSsliMi 

This PCi sypofNHflps Policy Directive (PH) (WHO, Counter terrorism Polity Guide, and Iho 
1 ihiinreffprmcism fttfrcy (Utkte, 04 WG. 


14* Refwwce'., links and Formi: 

H i deferents 

14 11 ffU UpffMSfrr lnYQ 9 &Q 6 &on* and Operations Guide (DIOG) dated October 16, 7011, and any 

approved, suhsequenl iterations. 

Hi* Fof additional references, (toy woids, and links, please soe IheCTPG. 

14.3. Acronyms 

H,3.l, AD: assistant director 

H.3.3- Atifi Dom: AfTomei' General* s Guidelines tor Domestic FBI Operations 

14.7.3. CTH: Counterterrorism Division 

14.2.4. CTRG: Cckjnferferrpntm Pn/rcy Guide 

14.2.5. 0P0: division policy officer 
H.2.6. FAD: executive assistant director 

14.2. 7, FBI: Federal Bureau of Investigation 

14.2.8. JPO: Internal Policy Office 
14.2 $, PG: policy OUlde 


15. Key Words, Definitions and Acronyms: 
<See the CTPO 


16. Appendit es and Attachments: 

See the CTPG 
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ill Supw^jOB tnfm td.itinii 

1,1 TOUO) This policy wide supeivcdrs (hr C&untwrlerronsm Polity Guide policy durtlivr 
(<MSHD) and die Ctn mtm tu t r ut 11. m Pohr 1 Guide ( 0494 PG) 


(Xj) This document and its contents air the propem of the FBI tf the document 01 its contents 
air providr-d fp an outside agenrv it and its cOfilents «e not to be distributed outside of dial 
apt He v without the written petmmioti of dir unit cm indivychiaJls} Jisird 111 the contact section of 

dns policy guide 
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4 - 3 . fTjf oitBtfftnron^m Piofr am < idJ^c t p^o PUlp 


tgflntOBli 


4.3.1. (I*) rnlpibgcui ■' ( uflwnrin and K> pen ting Strategy 

(U /FOUOJ Ln ail effort Ip sttndardi/jf m for matron and imrlli pfure col>m«m w urU % prc sde 
investigative guidance for both DI arid fT imestigattora CTD hm rstahi J*d m <i . I'-suratr r 
tiarnework collectively irfmnd 10 as basrime collection Tht purpose of bad 
lo guide invesliHatori in obtaining utfelliflemtr and using ur.ru ifOtne method fi 
of each DT of IT investigation Baseline collection » not mandafc^v and iw not an ail h 
listing but latbrt a brst prince list of item* ih* tttav be *: cutaplisoed *bea legalh | 
relevant and consistent with the DIOG during an assessment » predicted nr eUizancm 

(U TOUO) Baseline collection w as established to pfovtde fwr,Exau*Tiz»c stMjdari. m tern* of 
die quail tv and dwiougiiness of assessments and pcedutaied ur. rsiiFa®«» ftasrltnr .otkera 
can help prevent gaps m investigative efforts FC* we reminded that *U mve^pes* effort, a? 
%nb|rct to the AGG-Dom and die DIOG The least imrusr.^ ny a tr A tmevrig^aon. r i^liecnofi 
must be utilized under die AGO Dorn or DIOG frefey to the secaoc t» ka*t uarjsr,- naemak m 
die DIOG) Baseline collecbcti is intended to serve as i nude thiouai the ano* *n e^*r * 
stapes t 01 union sense will be applied when detetmmmf wbetiaer a pstmdar rfc^ r^cSwaed m 
die baseline collection pertains to a specific assessment or ic\ esfagatic*! If time n iotftt at id 
whether die appiopuate aulhonfv exists m an individual mvestiptiap to adebew a l 
collection item emplovees are to consul! die chief division co 
CTD piogram manager 


1 ax; OGC asdcf the 


(1 F OC'O) Supervisors mav address baseline cotieeuoo with _a-se agent s in mg imestizarr. e 
file reviews and such review's will inform many of the mtrlbeence and coUccibc tsanef 
leqimed lot review in accordance with pJ<X« subvert! on 3 4 4 6 b addmoo to ia2ad*\hrsse 
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infinTtvilimi and mddUgcnre i oUet Don IumIiw r^kffidl will lirlp to Httbimlk a (mini lain hi itf 
uilrllipr^ r upon which the Mil may Haw dir rW 'iwm tii i mitnuir m rbite :»n IftMntsmnit t* 
investigatnm 

(U Till TCI) Basel me coUrt Itiiti items air in no paitu nlar adn I iiillinmoi e mliMitulion iick! 
s all (n* by hasrhiw collection may also lie nillrrtrd if lifully p*i pearl r< al km I 

relevant to the invr^tigotion Efcwclnir coUrdion also tmrtilvn consider atmii of thr i mtjhliiy ol 
thr oiivnul information m tourer of iiifoinuiuru iei Trims of '[Urdu alum If (lie t mhhilily of Uir 
oHgnul mlomulum 01 wurr is evei siiUtanlialK qiirslitKied any futUirt owkU^imki iHLsed 
uqnm die iuic>muti>.ki n source mud be reevaluated 10 rfrirmunr whriiiri pirdn atiou contmum 
10 nwt No investigative m f tfio d will hr used if information is developed tlut Mpfiouidy 
innipinnurs the piajxisr nt prrtlti ration of (hr assessment 01 mvrshgaUon 

(U TOf'O) This sLurtlaidurd approach 10 all CT imrsti gallons will allow < IT> ami FOs In mot c 
eflrctivelv and rffkwnllv mamgf CT mvrstsgatiora CTO will maintain an open dialogue with 
all PO CT supervisors in endrr to identify intelligence paps p ovule gmdanc r oik! 
irvLinimmiiiii^ii. and ensure all atari able CTO resources are appropriately utilised m rath 
tnvrsiipttQci 

4 . 3 , 2 * (U) Assessuieniv 

(U//FOUO) In CT Type 1 & 2 assessments mvTSQgilon may when relevant to tlir ptupo^ of 
die asscssmml collect dir infos matron dial is necessary to artswei thr questions drtailed lie low 
is i lie pity A (tefrr to ihsgtfitfn \} of tins PG for a list of authorized methods) Thr 
assessment m*v cotiiiiuir until factual inhumation is developed dial w on ants opening a 
predicated invest! gatiori 01 until a judgment can lie made dial the target does not pose a teiionsm 
« csuiural threat Assessments mav nol rmum open solely to colled moir uifonnaiiciH if dir 
purpose of the assessment lias been achieved o* li the information is nol necessary to achieve the 
purpose See DIO O Section 5 for additional information 1 eluding assessments 

(U'TOUO) In CT Type 1 & 2 assessments dirre are also specific mandatory baseline collection 

tfqumueuh Refer to Policy Directive t,PD) 0649D \fan, fatory Ba sP iiw Collection Dttnng 

Cm mtertmran s m tC Ti jixror . ?vv n:s. fot a discussion and list of these requirements 

43,1.1* tUH ateeon \ <Jue stious 

[Y TOUOt To answer the C^egorv A questions accurately database diecks will be necessary 
This information is to be collected, if it can lie done with die methods andiorized duruig an 

agumfrt 

(U) Note: National security letters (NSL) and administrative suljpoeuas are not 
authorized during an assessment Grand jury sulpoenas (GJS i are luniled to subscriber 
ui formal] nn ools for Type l & 2 assessments See DIOG section IS > 9 Investigative 
Method Grand Jury Subpoenas - providers of electronic comnnuucation serv ices 01 
jemote computing services for subscriber or customer information 

fltf/FQUO) Category A questions aat 

1 (V TOL'O) The subject s full legal name and abases if am 
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sm Hi if/mmoH** 

(U) ( winter tor I'jrivn P'dw y * ewk 


(U) NiA* Sot nr rutirnulitm *id * ullirjf'* dci nrf Hntjinf’Mish firu 

Iasi fijuim'v rn til*- taut rrunrirf m thr Outer! Slaton Tlnrtj’ifjbfV’** r*wy irtfmr 
i Iw* Is fif earh of fV kmiwn imron prd m dir j*i*t tifjfi of the b*< njvrv 

) (UWKJt ID) IV subfrrt s date and anmm y id (nrfh 

I (Ltfff'DUD) A ftrtrrrrtiftjlifjrj df tV wjbjrrl ? Lnstrd Stairs pnv« rr H , -4atto 

uj ArtKtida* G |^f/KKJ f/NOKWK (torumrnrj of «V U^X/ 

i ([ J//H Jl JO) IV nibfrct i passport number ^ %) »d nximy of i r 

*y (U//FQUO) JV r .iibjrr1 s vr if uJ to* Ufjfy tnouVr ISSN) *jf (V siAy^i j* m r ^ V *#■; 
any other unique identifying numbm irlr .aril In daUhav ^Vtlu. O r aim f* p ! tfJ aii 
niunhrr and dnvn i luemr number) 

6 (U//FOOD) TV wtbfpfl v Iplrpl'itnjr rHmJjrfK t t mail arfdtovf r% jrjrl jf n«farr iatoTr** 

< oiiiminu* alifjjj media utilized by the subjen 

7 (U^/FOUO) TV uibjrrt s runmJ addr*"wv and am ptidf adrfrrWrv parbr.afcrh J rf 
appear. that the subject recently rtfocaCed It will iwnwllv V iginrrewJry to anr*r<an 
prrvtOUS a/kbrsses mere than five years old 

8 {(J//FOUO) The subject * cunenl place of mpkrviDent and pentoon 

{U//FOUO) When available identifymp mfoniialKm has, bera obtained if ns- r r t«rd to toeduci 
the checks nrrrssary tn answer the following quest**** TVs* qta^hofia ate Stoonaih felrvm to 
all C l assessments Only information about thr sjbjm that iv relevant to toswerm? thrv 
questions oj otfanwiv rrsolvicy tljr a^vnuitnl mav V dor ycomfed m FBI file*- r-jnpfr v* 
lo avoid collectmg nr docummimp prjvwiaJ mfoirinatiooi abend tV «^err thai b not trrlnad w> 
\he a-ssr^snirtK Thr question* bekm air not in any parmuiai otds and air not all ndina \r TV 
least LntriLsn r means if reasonable based upon the cuainistaoce* of thr jir.estiga&afi is to be 
cmsidned to aaswef rxh question UTuk somr databases are snf£eaed opea source 
uifomiaimn may also be checked to answer these questions 

9 CU//FOUO) Has the subject r\ei been the tmm of or been refejeaced in another FBI 
investigation" 1 Quen ihe FBI s central rec or^ceepmff ^vsiem Osiar <km and or 4* 
Invesugaiivr Data Warehouse (IDW) or other FBI recoj ikerpni? ^stems 

10 fU FOUO) Has the subject s current address or place of work been referenced it ^her 
FBI muesli canons'" Query the FBI s central tecortflenrpm? ryton IDW or ejehet FBI 
recordkeeping svytrms 

I I fU 1 FOUO i Does the subject bas e a cfimmal rustorv a conviction or an ares? * ±as m 
relevant to the assetaraeot s purpose^ Profir-rfenen crone; such as fraud nkiWii i 

sud dealing illicit naicotics mas be as rde’.aor to a CT asse^’aurta aft cranes of vaoirace 
and or fheaims \aobnom Anv active arrest warrant must be anted m the assestom* 
Quers federal state and Local minima l law euiofOMUBU c.vtrm^ »odi at the Natiocai 
C rime loformarioo Cenier (NOC stale Depactomu of Motor \"eiadcs D_MV and 
otlier local systems 
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m i KV r/ffllOl mkn 
(1 () < msueittmmiin 1'mln v f *untr 


1 1 (1 ' TtH O) K dine irasou tit Wlirvt- ill, it Ihr 1 lias hern m |r|r|ihonr t iml.u l with 

siibffr t\ nf mhrt I 111 investigations 1 It so •, ihii|mh llir u-lrvanl data i iw niiiii}' dir 
Mib|ri 1 ^ irlrpUw with 1 11! daub^ -, and as minim i 

hnk MiiHitm ;uiaI\ , ms Quay TelcpliMK* Applu atton (T A) 11 >W FoUfls/C leaiwaln 
Dna Waarhouse Sv^ptii (DWS) and Data \ jmding and Amdvxn System (DalAH) 

I 1 (1 1 ■ TT)lH>y ft thnr iimmui tn brlirvr dial ihr suh|erl Ins limi m r mail contact with 
subnets of mlicr Mil mvrsugatiom * If so irlevam data concerning ihr 

subjectse null «ocdtnl(i) until mi databases, ami is appropnalr conduct link /lime hue 
analysis Qutty R>\V Pobuis l IraiwaLn DWN and Dal AS 

1 I (V VOl 111 Is ihrtr any inson to brhrv r that the subject lias stirs s ID tu/nckitis Crt 
explosi vc nulritals ' An uidu atiun of such nuv mdudf any special In enses m promts 
(f p a vmumemal ilnver s license [OIL] with a hazxidous materials |Haznut] 
endoi seruetii ) dial authorize die subject to obtain oi possess explosives tn othri 
dangerous mater ills 

1 i (U ' TOUO) Is there any learon to believe dial the subject lias purchased or is hcensed 1o 
possess firearms or other weapons 1 If so niuNCIC checks andoi con tact local Bureau 
of Akobol. 1 etuceo Fnrarms and Explosiv es (ATE I lepiesentahves or any available 
state database in the relevanl jurisdiction to collect responsive iei. olds and information 

1 6 l U TOUO) Is there any ira.son to believe consider mg the subject s background 
mq)ki>TnKi history and cnmmal lusrory that the subject has received specialized 
naming or experience or has knowledge dial is relevant to die investigation (e g., military 
service bvv enforcement firearms explosives pilot aviation scuba diving engineering 
architectural conipulei science, pharmaceutical diemical biological radiological 

tiuc leas or smulu subjects P 

1 7 (U FOl O) Within the past veai lias the subject traveled abroad to a country(ies) 
relevant to die assessment 1 Query the TECS Airl toe Reporting f orporation (ARC) 

DOh s Consular Consolidated Database (CCD), andot a DOS liaison requesting an 
CSPER subject s passport application history 

18 (l- ffOUO) Does the subject live alone or w ith anodiei adullls ) 1 If the subject lives with 
another aduh(s) is there any reason to believe said adultCs) is involv ed w ith the matter 
under assessment 

19 (U TOUO} For a subject with an uilemalional nexus does die USlC have any relev ant 
information about the subject 1. Query the FBI s central lecordkrrping svMetn Guardian. 
[D\V die National C otmterterronsm Center (NCTC) Online a DOS liaison {noii- 

L SPERs only) and or other USIC databases 

(U TOUO) Not* Die appropriate CTD program management mm can assist m seeking 
information from foreign intelligence law enforcement agencies Contacting foreign 
agencies L\ a relatively intrusive step because il leveals die FBI s interest m the subject 
especially tf dial subject may travel to that foreign country m the future Accordingly 
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(Uf f ^nbiirTtonm M* y<*ntir 


vik li t ittftM U rruM Iw rjotvdnntld (luoufrfi f *ITI 'jfify thr irif'*r™**n 

|ii«tlfm rhw IrvH tif iritiiAUjn 

m (Uffl-OVOj Could dw 1 k pi li or rj|>in *tivitor\ tvaMnaArfy vjpjx*l rhr nr m 
mllirtiflfl m !i jmfri urn try >n fund* U* terror Mi r* r nnmtM purprfu-i (r r 
Ofnft/mifnrt owririto , .J»p|Jixjf' '4*Ji bwnt^xP Jf m 4fr. ffcr vAtytri rur.* my 
|irrviiiu\| y irlmtifirrl ftHpinaui rrmei My tntr,*Wxr Rrvirw tuspv jrtivtfy 
KrjHHls fSARj < ufimry T ians«*r ljf>ri Mi-ports ff 'I ffj mA € y nt fA>w+lM* 
Instrumra! Kqxjrls ff.MIRj <>jny tfir I trutv mJ fimrt hufcfrjwr* .Sft^r^rir , 
(Frof'RN) f rtrwav fituiav' 


4.5. (I") ( ouutt-Hej i oiisru Disruption 

(U r TOUO J Thr disruption of s predicated CT ur- rsirnafion occurs wbm i drhbrrjw law 
enforcement os intelligence action allers 01 nineties the normal and effective ofjera&w of an 
mdiv idual a gsoiip an or emulation 01 an enterprise engaged in tetfonacu -ar artr.ihri at 
preparation for or support thereof CT dismptoosM n»v anh br rbimed m DT m IT 
investigations and forei hi police coopemnoo mancr s related to DT or FT 

4.5.1, (I") Disiuptiou Strategy 

(U TOUO) Hie long term goal of a DT cn an IT muesp^atiGn * Sc dr.riop gaeSi« 5 >c* 
regarding all aspects of the terrorist threat Properly targeted, responses wiE «JJ r isUhir 
intelligence prior to con ducting overt disruption ktmtei while mjffitainmf the sf 

public safety The value of the intelligence coilecrKMi m relation tv the oamre and agrai* axe of 
die threat and the negative impact of allowing the subject 3 anr.iue*. te . -lestssue bsm* tv 
cousideied when making the decision 00 when zad wbnfaer 10 disrupt a sabtecs ? ' 

(U TOUO) If the risk to pubhc safets is too great or if all umificim usteiliffry r has hrcn 
collected and or the threat is otherwise resolved inyestisason. nav wish piofra r.v^^ p^ynera 
unit coordination and concurrence implement a disruption siniegv 

4.5.2. (IT Definition of a C ounterteit onsm Diu option 

(U FOUO) A CT disruption is an affirm* vr action' % h\ nie FBI m a federal -jre local or 
foreign partner m cooidmauoa with the FBI winch aei«raliZ£w tie threat posed bv u* FBI 
terrorism subiect U e an individual a group an orgsuzami os: an euserpnrf a*er aUk e 
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hhy claim the dtttUfrtian of a given sub|rti as a statistical # i arujihshnv'tii Any odbCf olTirr ilia) 
makes a ngnificaiit cnutiihitinft to the ilitiiijitinii <r p, srevrs a wanaiil in conducts into views) 
may ilaini a disruption usislan'f as a suiistn jJ ar i otiifilislimml In the cvcril 1 1 K ilisajgee as in 
tvhirh office will 1 1 Aim the Tvj upti^n the issue miksl In* [iTcnrd to tin* ajipioprialr (ID 
Proliant maaugrn Ktti section far resolution and deanoo 

(U FOUO) A successful disruption stoatepv may employ a iangr nf tools lo pnssddv include 
arrests deportation* interviews, at source directed operations to effectively dr aupt a subject's 
xlmbrv As a best ptaetjn* when w an jailed all subject interviews will specifically address ihi* 
subrrci s activities And poirntial lecnii Uncut as a CHS Examples of somr investigative actions 
shall ol i crutunal chaipe that could disrupt a tnionsr subject include 

■ (U FGUO) A tax pHrd interview of dir subjects) 

■ (U FOUO) Source^dtrected artmurs (e p. providing diMtifoi illation) 

* (If FOUO) A media campaign to publicize activities in accofttmce with Office of 
Public Affairs (OP A) policies 

■ (U FOUO) Revoking an nnmgnticio visa 

* (tf FOUO} The seizrnr of financial assets 

4.5,3. (U) Disruption Rcpoihue 

Supeisedrd bv PD 0 h 1 \D, Outdone* fo t Cimnwh? /mvifigiiftye ■ m,i forp lliemce Stoftsti ati 

Atw j^splishrnmts dated 6 30 2012 


HM HI ItfNmtMN 

fl 1) 4 t-JTi PtAtry t riu«ir 


5. (I ) ( on uf Frier ruriiin A*\fsMBM»iits 
5J (1 | Purpov «F C utmtfr ten orl» 

(l WOt JO) l irt lIk- policies and ides refunding (hr conduct of ^wrssmmtv tefrs Id UlOO 
Section *> 

(U//FOOO) A CrtPjJrh^i miry lUUSl \w rompIctrH cm all t cHmurrimmism cOrjAmls turh * a 
threat repoft or SAR even wfwn j prrdi * jn-d invrslj potion m opmrd Id those telim wteie j 
pi edit air d matin (PI full mvOb^OL or El) » opened a mninuii Mgrami of Mortal 
information regarding die inarm muvi br rmnrd mtu f<uaidian and 11 m® thr Gtiaifkro lead, tru> 
\yr closed for Uie purposes of raperang the PI full in -rstipalicin 

5,2, (1) I ypes of, ami Bask K tile for. f I Ivsei inent- 

(U//FOOO) FOs and f TD wdl utilize our of two models wbm rDoduropg CT aksev-nirair 
1 (U//FOUO) Guardian based (J ypt I Sc 2 assessments! 

1 (U//FOUO) Assessment! investigative file based r Tvpe ? and Tvpe4 rosemcifti] 

5.3.1. (I7/FOI O) 4rU.iidi.in Bast'd i type 1 A 2 Aikssi&Mh j 

(U//FOUO) Although Guardian is not an investigative file jnanaprmmi ^vvtrm it does track and 
manage threats and SAfU during the information coUrcuon and lead mmgatxm pmod » well as 
allow for the ana Us is of trends and pakrms of dural and suspicious activity FOs Lee^s rod 
other FBI entities must enter all reports of actual or potential lerrocist threats and inspected, 
leironst activi ry occurring within the United Stales or agamsi U S mtere^t^ abroad mto 
Guardian 

(U FOUO) Generally items entered into Guardian are those activities incidents or rfvr. m- -tr, 
(including citizen complaints 1 that mav have a nexus to terrorism rod mas be ixuiizrd id detect 
obtain information aixnn ot prevent and protect against federal crimes or threats to the u a ryn a l 
security 

(U TOGO) An FO must create a Guardian record to summarize the oarisre of ah terrorism 
related threats and or SARs If the FO opens a predicated tnvesfcga&oa subsequna to the 
Guardian entrv die FO must update die Guardian record widun (be Disposition tab rod 
include the predicted investigation file number m the dosing disposition The Guardian re ord 
must also be serialized into the FBI s central 
predicated investigation .Also if die FO sends an 

Information and Operations Center ■ SKX i CT MU 

management unit regarding a tmonsm- related threat the FO must mm the event or sinponK 
activity into Guardian (unless it is already part of an open lmesugatsoo and m w* previouaJv 
entered into Guardian i 


1 (UJ All wsei of the wi»rd »»»ion)i m*v be prettmed to meia sn AGO -Dcm- s 'j*ac card irsei r is\«5z*y.» 
jc&vrtv tmlesi mdiciied otht raise For further corned on meajusft fHa A 
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SI ( HI r Mil uu> 

(1 ll I intni«i(rn.ni*in K N tl»* y UmhV 


|1 1 1 H 'I )) \w 1(1 may min mlmtiLdimi ifHainrd limn j dm iimmlnl I US min ( nun Inn 

falwrVCT rfiuits must It hi tihu taken la iwntrs I il>r t MS s ■ mtlnlmli ably *n1 rnsnir ilnf line 
mtiY is in i mipslijn* i \% lilt ( manli ui |m‘irN ok Any inMmih.Hi ilni i miM utmitlv llir I I IS 
p « mlr lumie) nuv ihh It mined m Guardian Hein Ui llir * m adiau lull 4f*rl puj^r 

(T^ 1 1 il d) ISon im lluilMjH'inntl ukl u( iisipiit iey|vi trim I nitty tin t >ii, null lit r- seem mils lus 
Imm iitifmnl to tfic AR t within the I I tt 4 ln li Any llhirjl nnli|Mlnii luur^ iw juwnifMJ |si)m v 
( tolatHWis tiwind in 4 ( iiv.ii iLun -issrssniml liv tlir AH 1 rtuiM It twuiudil In lltr frs|MHisi 1 rir 
oftu r v attmtHWi iml wilt trquiir 4 rntpcwiM' an d m * Imu lit lump iIm iiw itiriil min ' «ni^*l 1 jiim r 
II 411 1 0 m 4 ill v 1 Mm 1 Ink to 1 min t m t Ludv llir itiuidun tin ulnii within 4 irauirijhlr 

hmi’ti lUitr ifH inti t*J <i» immmHiitm it* (ton l mid iin f 1 1 flu the rmtpansibl* tfffif * This hi will 

h* miiinroinmi in llir im rsiiiuiivr filr and 4 1 opy jimnirtl tn llir AM I file 

* 3 I I (1 1 1 \v o| Ariw Suh Uifwinml I lies 

1 I 1 Ol c H All (tiLiii.ti.in tawed assessment* dut ut not 1 on trued tn |nrdi* ated nnNi(Mi mtiK 

wilt hr n|tlivj(lnt tr 1 /m? sub assessment frlr upon foul disposition of Ihr ( rtiaiduii |rj*t Hiese 
1*10 «||v lN^sUglMllr^TU^tJMNfllCj^njlM^tn^MlI^ II "I ■ Hi- Will IS] I f.H r.KJl dpi 1,1 

drsigujim ( fflu 

jssrsMivm! fi jlit 1 nnl uci ill ik* ummUlmli of 

mvi-MirjIivr ii lmli ippovik use nf lmestipamr mrlhcids pit permalrd during dir course 

of ms isvessnimi 

? 3 3 ill Ol 0 ) VssessmrHl lnnni£itiur J i|r llasi-d ( Type I 01 I vp #4 is^esMinpiiivi 

(l ’ KHHJ) Assessment investigative files are used vs hen conducting assessments fm llurjfs ,uul 
vnlnrtahilidr t (Ixpe 1 4s^Miirtits1 and inl^lliftrrii r atbklvMs uvl jil.ituiui^ -si^fiuin xulv^U 

iTypr 1 mtonQA) Sre DlOCi Semon s foi fur dm utfotnubnu ifp<Kdmp amimaiti 

die 41 1st 

. 

^irf^vnmvi *m\irs uuv ikw hr doammttrd m couitoI 

An (pat thr j TO irn^ljitr 

S 3 <1 1 ludmtiNl lldbocls 

(S “NT I M\ mvfttigttw rurtlKsis outlined ui thr I >HXj 2* bring antlvutLSTd m in assrapmit 
mas br nurd wntfi the au qUiWl of llir npetation of FBI C HSy ctui^tdr dvr tmiicml (urisdictioti 

of dur dental StajeH 

4 4 |1 > B 4 v« 4 uie ( i»LI*€ Mnii Plan 

il KRX)) P(outg an -in FO nni coaiub (%bj*n n is irks Jail practical arut legaUv 

pmnissfblr . tudut tuii? iIt items outlined m ; jtegors A widi respect to idmdfvuifl informaliao 
far each wdwnrt in arecwdasK e wilh CTD s baseline rollecfioii plan nullified ui suhsedK »ij -4 J . 

of this PG 


s|l R1 I MHOR> 


sit vt ops 

< U j ( J j < 4 k ***uAr 


^ (t/j Q|liai|| <n I V(I* U ^ A«r *in«l 

Cl un t n JO> Dir inHMftMifj ui 4 \ vj * t & ) m*+ * wt mM by m H> r^, ** ^ by r f, 

( riMfdum I miiwl nfrfifi# aiion « ##if iMEfunnl to * ir **■. »# r t ™**rrr*» #»* 

I Ins U k of If if rtEuiil nutifii 4\*m rtf***, runl r\mmi 4 r dv mmf f»ir K H to * 7 1} p -jfn't 1 - 
informed of dural mFnrnLitiufj in ar Mjrd«vr *#f>- tutae* ’*h® * nf lb( K# 

(UtfFOIXJJ Jhr Qpott|| rtf 4 hir baaed A^wnif rowi hr **4 m appi'qr^r ■ f 

m arsf ctfdamr wnib Llr JJjrXr 


5.6 (!’) f kming nf a f*J \.rir*M 

(U//POIXJJ Prvm to < Iminp 4 Cni*<k« bawd KVfBgftf al rv^jiv rffrjfi xtKzM fa* *Mrfr k 
ir» h 4 ilrfiTunxr i ofw Ihvh m a* to dir pmrntuJ ttifJi of a 'ternal w^jfaowC or mMmmd 
srrunly tJiTfjto.j pr^-rj by (hr wjF*fe»1 m tjurataoci If a rkai amt laaaeg 4omn> ra» fa- wadr ai 
to the ptrtrritial dural dir i a^arduf) ok wfmi tiwM warjtjdr m fis dnyutowar m iW»»" of *>■ 
of Tfo to liar cgunt&on rrpaidmp nexus to Imonwi If ftwir j* j*»6f!V ni Ktorma^r v* seicr 
4 drfmiUvr and la r .lw drift nunatMjc 44 k> fhr prjtofAuJ dvrat dir d^cmtni nav V *ericr7. <#?- 
Intone Fuitve Uw nf Ihr irrare luw\r tnaitaip rtf-jar- that M (br baw of knee ad 7. atldbir 
rnniKn and imrsttjMlivr zvtnun haw bem exhamard acid toe I T 5l fOMi imrfdr to 
rone ImivHy tlrtniiunr t* briber m tvM the Mjbym dor-, or tiu/is* » Sbr hmer pear a Are* 


(U//K)UO) The ckw-irjp of* 1 1 *H>rvyn^if rontir^ar-r fdr ova -mm a <tem 
coocemmg any identified criminal viobfKW*. ’ or iua»ur^ ter ijruv feceafli i and « 
findinp Uul tlir file no lo tipn ao JiMhorurd purpcM 
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*8 (I ) Online lnvnligiilioiK 

(S RL1 1X1 USA FVEY) llic CHI 1 ptogram manages unique CT Internet mvKtigilnos dial 
laigel imonvts use of die virtual realm whrfr a Web w\c or online network of individuals is dir 
Lu gel of the investigation of wlieie biter net exploit non is die primary investigative method CT 
subjects m,iv me entrains* Well sites cn forums to engage m the spread of exneuusi ideology 
and oilin terrorist activity ("cm dilution with othn CT projgam nianagemrnt units will oerm as 
necessary to determine die appiopnale progiam management responsibilities based on liic 
subject s Internet activities 

;S REI TO USA FVT Vl The online targeting of an extremist Web site 01 online nrtwoik is 
considered a sensitive method There Foie any information regarding tlie targeting of such Web 
sites the public disclosure of winch would reduce the effectiveness of the method must be 
classified SECRET REL TO USA FVEY m accordance with NSRO. citatum number ENV- 
’0 Tins applies to details nf the method that have not been made public even when use of die 
method in general has hern officially acknowledged 

0.8.1. i\ FQVO) Types of Onllur luv estiva tinns 

(U TOUO) Outlined below ®r guidelines for when an investigation will be handled as an online 
investigation Questions and consultation may be durcicd to CFfU when a deirmnuatiou based 
on die follow ing guidelines cannot be made by an FO 

^ ft.l I fS RFl. TO USA. FAT V> F xtreinid Forums and ( barf Rooms 

tS REL TO USA TV 'EM Online investigations may be opened on suspected terrorists or 
Carons* groups dial use Internet forums chat rooms bulletin boards blogs servers and Web 
Hies to encourage and recruit members among English-speaking audiences tn Western nations 
CTTU has noted a trend that al Qa ida and its Snaru affiliates aie attempting to reach non .Arabic 
speaking Muslims who live m the Western world online in efforts to communicate eslremisi 
fihidist propaganda tn Languages native to Western speakers Web sites and fonuns espousing 
such propaganda contribule to the radicalization process and facilitate the recruitment of 
ludra iduals mo terrorist mg&uzahonv and cells Surveys of extremist run fonnm have 
determined that English language fonuns have led to llie nse of tenomt cells entirely within the 
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it JO 17/ . Ol Oft* 

{( J) ( ./fluantr tiftti ‘ 4 h Mtt V 


I’MNiils of WrvLni) lUfronft ili-rt Mr larprfy jjjdrprndfTit *>\ - J flu* r*n * w* * ■ - b *•. 
tjadjIlllfiaJ (rm#ml |r*k‘f inji dm**! 

9 ft. J 2. (S//KI 1 . I O f SA. I VEY| f of <mi 

(S/AliiL TO USA FVJ: Y) fftilif* If/Vf- may br osa *!mmi'«4rjr r/ j'uifnf 

forums tlur arc being lifted u> far iliuir mimulitwnf traioutf ar*jvjry to m* tad* ^ 
invest have ifctiiMistTatedJbf tjatos^nf extort ,: \i*t J / 1* i**j» * 

wit} jin foreign IcfTorifrt orp^w/jttom Die adrimiJ'tiMis*' hj? if. ‘fjmxn att! itjn&sj 

and njimiifi hs iArli as the senior Jradrrshrp of terrorist n^Jtisra «fcio2»scr4*«v 

may unhide individuals wdiD create ilut room 1 Ijuli^tro Uja? r F 2 i r ^> *-s rr Ae*. • v- 

0,8, J ,3, (5//REL FO I SA, f VI Y) Jorum Pjrtu iptil* 

(Sy/KEL TO USA FVEY) An utv«tj^m may be cinder'd mi qiuW m.rstiiseirti « a 
pr manly based on a subject s onhne actmiiev and partirjpatjrjfi wab fisrirowi forrra -bit 
rooms, bulletin boards bfopv sit vers cm Wdb .ite foram psitj ^ nay ^de ir*Y, tdiate 
whosr pi m l;iiv activity includes die development of tccuiziiiarjucKn iiSnxitv pran>rj^5 m*t 
individuals acling *s virtual couriers for tenon sf argamErfios* bv pse J '.n#- vr 
among member* m leadership Other individuals nut turning these mum bgf idrr*-f>d 
through die investigation of extremist forums or minor networks noLisf be ip m off for 
program management by die appropriate CTD program managruarBi \mM Mid FO 

9 8,1 ,4. (F^ F se of Online Methods 

(S//REL TO USA. FVEY) An investigation may be cocsidcxed an online when if 

uses exploitation of ihe Internet as its primary method of intelligence iatir7&oe x 
Examples of such methods include the use of online OHS* online cover* a^krffi OCE if 
tlie electronic surv niknrr of hiUrnet -based faobtirs 

9.8J,>. (Fj Joint In res ti^ntions 

(S//REL TO USA, FATLY) .An iovrsugatron may be coosaderrd ac otdiae nr,e^fcgaiiQc tin 
opened ni the request of a USTC or allied foreien partner to expbfl larorias s* of ar jimet 
As die majority of the world s Internet infiasu^-r^r ch-L^img Wff - :te jx-s-rnff) r based s tr« 
United Stairs it is anticipated CTD will pursue opporvirnues for FISA : -baned 

sen ers when requested to do so, and when it ls appropriate:- predicated bv a Y SY a? al^ed 
foreign partner 

(S REL TO USA F\TY) Multiple agencies of dae USK c^Jndm? the CI4 and the NjMbI 
Security Agency fNSA) have robust efforts to expbn tmonsss w of fa: Izaerart CTD 
activ ely ep gages these partners with the intent of establishing and prepertv- kr eragcEg ihfie 
contacts to nahance FBI mvestigatKins against common targe?; fn csrier K> b lAsaie mlaraalas* 
exchanges and lev erage allied resources for the FBI in the drveks one? of)cid opecaiic^ r TD 
develops relationships with allied foreign mielhgeace and law «tfw ■: ernes? piA^er er- aaneti 
inv oking terronsts use of die Internet 
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« fi 2 (1 lorn) I ilqn# wfa Fiw h)iih^ fin I is \ < nllfl l«*i* 



JjMlIrniMM I III- ni'UH.J II qillH'IIH nl of fin 


h* MSA coljediai outhned m die UP H» -um! m 



r, IN i 1 1 14 kitlouni.' *.Mi'n>rial i fc a. m eduiC'* llliol In- Mhiucd 

wlim a i TIT managed l 'Si* par tori I ISA package tv bring prormd foi tubciii^xin lo tfir 


KISC 


1 (S TO 1 TO i ! SA T Vf Y) The I HI <bn Iran (lyph .Jh j ( m I SSA) fat dir USIC 
P» kapr will pmnallv «mve dir tag? via dir cammimity of intt-icst (CDI) m TOP 
SI C R| r tTH)r mail 

* I.S RJ 1. TO USA FVF Y) The declarant niiiM review the pjrJtagr noting dir specific 
pascs/mhiiiiwiinn related lo ihr FO responsible fin (lie investigation and send a I S 

r mail in dir respective i O requesting a limited Woods fmm foi dir specific 
pages m/nmuluni contained m (hr FISA package related lo thr FO s 
inirliipcwr mfomwimn 

\ I S RT.l TO USA FVTAT Thr FO must review the vpenfird pagrsAnfornialttifi verify 
that (Iff facls are accurate ;uki3 1 oinplrlr a Imnlrd Woods form with nutations statu ip die 
page immhei and thr specific paragraph anchor information verified Hie limned Woods 
foim nmsi subsequently be srm to dir CITT 1 derLuajit 

4 (S Rl’X TO USA. FVEY) Hie uiformaiiou described above must br maintained iri dir 
FISA Accuracy subfile established for ilw* captimied investigation where thr 
mtelligmce mtoiiiLitioii was derived The informatioa must contain a notation on which 
F ISA package it verifies 

<1 FOL D) Upon completing the four steps above FOs must 

* ( V TOUD) Punt die e mail requesting ihe limned Woods form 

* (U TOCO) Punt die ‘specific pages 'information from the FLSA package 

* (IV TOCO i Attach copies of die documents used to venfv the FO s information in die 

FISA package 

* (U TOUO) Attach die signed ouginaJ Woods form 

* 1 1 ‘ TOCO ) Forward die package to flie CTTt " who will arrange transmission to DOJ s 
NSO Officr of tnfcrlhgmce tOIl 

<* H 3 (1 FOUO) Joint CTD C vbei Division (C yD) Investigations 

i y K£L TO V S A FYEY) Due to ihe polrtiUal foi overlap regarding investigations targeting 

ten ousts use of the Internet CTD and C yD have niiplemrni rd the following procedures 

* i S RFL TO CSA. F\"ET> An FO oha squad must immediately notify the FO CT squad 
upon opening a Coopjtef Intrusions Intemaiioml Tertonsin ( ws rstigative 
cJjssificatioti i PI oi lull invesligatioti The CT squad SSA w ill identifv ? a CT special agent 
(SA) to initiate an appropnair parallel CT mv estigatiofi and lo sene as a C T POO Thr 
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SM Kf it 

(17) ( l J *A*r y (Vadf 


Pt* Will rmmr Irveratfifig f d 43 u4j‘*»d ^ *rty lr^-. u> f)+ A A* 

mvcma&ttan 

• N/HH.fOIISA I VI ¥/ If a f I vqiiad drtrrmtnr-* * yfarj *rtiYtfy evasti to a 4) % 

m v rsli ff hi dir ( I S5A nw«f contact dir r fin SSA hr An V>A mV, *i+t. *s»to* a 
ryhri April* -« 4 KX After coUafx^teUfif, dir vbrf vjuad *:K Arbn< ^ * J* + r.n 

if any dir jfivraifcjliun involve r ytjrt tmi vn'ri jru , o , «id vrdl jpnr, * ».j 

mvnb^Uion if apfwfjpttalr If there u no mtrtMoti arhYtty b»Jt a need for 
HitltMff cxjfti llir 1 7 uju#! may request (hit fer rvber ir}ua£ jprx a '4?JI r I er Ihota^ 
Support In CTj uivmi^acion 

# (S//EELTOUSA I VEY) All 152 awett^ttoo* wwo+vtag ponJ> 

investigations must mrliKte m thr disUibutUJn f /jfiniflTfttMdyji Atm f X v f HU 
Cyber Division Attn CUSS Each nwiw— i in nwl be filed m h*A 41 

investigation'* 

« 8 4 (S//RTL TO I SA, FTLY) Online 1 od#rri*#r and ffl MgHJ Oyer lliw 

(S/fltEL IQ USA FVEY) IV requirements set forth id iercctK*} > ' of i*t PG r~r*4v>r 
ruaijoTLil secunty under rovn operations apph to all online UOO| tar istfhng lfae Nei I akn 
National initiative fNTNI) f refer to vutocctiop 9 63_ of lb& PC) 

(S//REL TO USA. FVEY) Any IT imesupiion imLtzmf the undoFcovCT method m wr&emiam 
online extremists and or rjttrrnusl Web wtes including but not hunted to forjcr ;*ar ratmt* 
blcrpv and other Inter nn tedmoloprs must be ronsidrjrd a tfnutr.f tarrunAaor e and *dj 
therefore he a Group t UCO Imtuuoa of CT online UtOi rrnsa be coordmasnd wilfc C ITU' 

CTJLX and the National Sretin ly La a JQupcj. "NSLBj Sucbaebar UC f r ntt * V - f r 

C ITU and CTUC ftw inclusion into the NTNT h efe ic vina e- 9 X 5 of dm PG> 


0 ft 4 J (t > Dec on fin (Km 

(S REL TO USA FVEY) Lhinrip an crnlirr ur»Tstis?ttoc it is ui^wrattve ihm tie R> and CTD 
implement strong source deconfiicnoti measures imaifiicien* decMifiKtron narafem^ **h die 
difliise narnie of tlie Internet bas previcuslv resulted m r«ourc« being w»ied nr es&zi«si r 
m collectiiip on FBI online identities 1 1 e undercover ec^bwes (UCE j OCEv CKSs *i» h*ve 
aireadv Irem investigated Ln other FBI offices the USlC and Ot & aUied foreign partner 
Increased colbboiaucm and coordmauon regardtnc ooluac UCE^OCUiCHS^ & accessary to 

1 educe die problems of self investigation and duplication and to enhaocr tfar FB! ^eoli -ffbfK 
to counter lerronsrs use of the Internet 

( S RFX TO USA FVEY) CTTU T u the lead unit widim CTD to cfcc/fifkrt all matter, perjesns# 
to online ideirttlies The Net T alon database i refer to sulyygdiqp * S of diss FG \ mat named 
and operated by CITU identifies deconfiiction needs for t±^ ni —rmii onhne abases aod 
mamkm of FBI UCEs. OCEs CHSs and extrama Web ut« 


vFf R£X NO|OR> 



Jilt Kl IWNOMWN 
(U) 1 tii uilntm nan satt Policy tluidr 


f^g.5. (I TO t O> \vt t .iKhii Nation*) UuU*ii\t 

jS- REL TO USA FV t Y> In May ’008 (hr NTNl was appwd by tlw < ID Hir NTNI is am 
online mulmovri nttonal initiative rowan*- ted to sbatrpiraltv fotsis opeurtinns (nsinp OCEs, 
UCEs, and CHS*) targeting Icrmtsis use of ihr Snlrtnrt 

(U TQUO) Foi further details rrpaidinp the Nrt Talon Piopain icfa tet Section 1 / of this PG 
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Id.ft (1 I OTO) Ou tin* Investigations 

io.il (i foio) ispes or online investigations 

(V TOUO) Outlined below Mr guidelines for when an investigatiot) will hr handled as an mime 
invest! gal ion Questions and consultation may be directed lo DTOU when a detei imitation, based 
on the guidelines below cannot be made by an FO 

10ALI. (I TOl'O) Extremist t ui uins and f hat Rooms 

(U TOUO) An investigation may be considered an online investigation when a suspected 
extremist or tmoiisi gioup uses Internet forums chat rooms, bulletin boards, blogs, servers and 
Web sites to encourage and recruit members and the investigation is unmanly focused on the 
online activities of the extirnustt s), Web sites and forums espousing such propaganda may 
contribute to the r idealization process and facilitate the recruitment of individuals into domestic 
extremist organizations 

ft FQUO) An invest] gallon may be considered an online investigation when die matter targets 
die adnu rotators of Intenjet forums Past investigations have demon sir aied the admuustiatorv of 
extremisi forums are often key facilitators within domestic extremist organ izahons The 
adinuu -ti sicn v are often m contact with senior leadership of the organizations or are members of 


7*1 

bEf RET NOFORM 


M%f ki ifmmtmM 

(U) f Pot* y < 


Uk* cil gani/altous ihei j iw I ve^ I n» um adfnihf sii 4H*% mav »* Jiadr Msdt ■ wbii ih who c r r Mr *. ini 
rooms, bulletin boards, Mops. wiverc and Web si Its 

HI 6 1.2 (Vtff 01 O) I or n f*iriirifi«fi4< 

(U//FOU 0 } An mvrstij^Ucin may br roniirinrd an onJirir when Ar matin t* 

primarily baaed <in Ihe Hubftrl s onlmr actVYftK* and pat* ip*ion with efifrnft* farurac rlut 
h Kyi ns bulletin boards, blofit MVfn w Web sale* i vtvm furv ipanU may uv hi rfe rndr sufciak 
whose jiriTiuf v ju Livitv irK/lodr* the development of orntruumc at]**,* vriMjty e\ r* 

individuals acting as virtual council fen docnrstv extieimst cfgjuizalXMn by praartf’ unbrir 
nirssagrs among iriembns 01 leadership Other mdrvtduah not mrettnp li^sr cntera bi* 
identified ijmmpji die investigation of extremist forums Of online network*' wilt br spm off* 
for piogram nianaprmrat by the ap^Kupiutr FO and DT program manapnnrni unit 

10,6.1.3. (U//FOUO) Ltf of On bur MHhorfs 

(U//FOUO) An investigation may be considered an online im estimation when d u»e* expfcfltation 
of the Internal as its primary method of mlclhgeDce collection of in vrstipaticin Examples of surf* 
methods include the use of online sources, UCEs or electronic wrvetllanr r ofbnerort bawd 
facilities 

10.6.2. (U/yFOUO) Joint CTD/CyD Investigations 

(U//FOUO) Due to the potential for overlap regarding investigation* targeting extremist use of 
die Internet CTD and CyD have implemented the following procedures 

■ (U7/FOUG) Upon the opening of either a Cofnpida Intrusions Demesne T mw tan 
(?.S$K classification) PI or full tm^estigatioiL the FO cyber squad must lmmrdjjsek 
notify the FO DT squad The DT squad SSA will identify a DT SA to inmate an 
appropriate parallel CT investigation and sene as a DT POC The POC will ensure the 
leveraging of all national secunty tools to address the tar gets of the mvcstieatioti 

* (LV/FOUO) If a DT squad determines cyber acuvin exists m a DT ms estimation. the DT 
SSA must contact the cyber SSA The cvber SSA will then av 1 eh a cvber a gem as 4 
POC After collaborating the cyber squad will determine to whan degree if anv the 
investigation involves cyber terrorist intrusion activitN and open a 288K miestigatsoD. if 
appropriate If there is no intrusion activity, yet technical assistance needs exi_sr the DT 
squad may request that the cyber squad open a 288G (Technical Support to DT i 
investigation 

* (U'FOUO) All 288G and 28BK investigafroro invoking parallel E>7 uivrvft cations must 
include in the distribution Coutitntenofisiji. Attn DTOU. and Cyber Dm^vti Ann 
NSCU Each comnrumcatiou must dual caption the invesu nation ED number to me lode 
both the 288 and the appropriate DT classifications 

10.6.3, (I' FOTO) Online I ttdfrcovrr and HI AJI>T Op^i atious 

|T V FOUO f Hie requuerueuts set forth in sub^ectiop IQ T. of dus PO te^ardmg DT undcrcoiTr 
operations apply to all online DT UCOi 


SI C RL I \DFOEN 


SIXTH. ‘ 17/Nl H ( IK N 
(U> CoUiltHtettomiti PoLm"V Criudr 


ifliJU. (t ) IVtoufln ti«m 

(U TOUD1 IXmtip ail online invrstlgancm H is ht^ktt atnr that tfir H) and DrQlJ implement 
<ttonr mart decflaflidum n^avures tnsuffident deamflirtion combined with die diffuse 
tumur rtf the Iniemei hai previously tr sidled m resources bring wasted by investigating ot 
collecting on FBI IK}E&/GCEbCH5s who lave already hn-n ipoti§atod l>v otha FBI offices, 
the miC, and/m allied foreign partncis Ina cased collaboraiinii and coni dilution irpardnip 
online UCE&'Ot'Es-CHS* is necessary lo i educe die pmblnns of self investigation and 
duplication., and it enhances tlve FBFs overall efforts to counter terrorists, use of the Internet 

(U’-FOUO) DTOU must utilise the Net Talon database for decoiifhrtion of all DT online 
ixivestualioiiv Rcfes to subsection 17 \ of this H'i far mote information on tlie Net Talon 

Database 
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Sfjf KP pz/NOfOKN 
ft ] j I ouniJTtrTi tirism PaW y f i-tiide 


II. (1J) Terrorist WjitchUitipf; 

III. (U) Wair Idi-Tug Amir v 

(U//FOUQ) lilt* USC# maintains 1 cw»oJi/i*trfi fast of individuals who *r known tw •; led of 
being terrorists llus fast, known at liar 7 moral Screemnj' JFatdjav 1 si rjMtnt*xrrd fay dir 
Ttnofisl Vieening f ojln fTSC) Thr siibumsion of an train idual to riutnHiVi’ e, rnockfi*' atran 4 
and apfriiTpi sale removal of thr Trends within If)* I SI JB is referred Uu as itorff hlisttnf 

(U//FOUO) The USG s consolidated tenons* watch! is* is a cniva! to^! tor a nnrmn? f I j at t.‘ S 
borders and ports of ctdiy. (2) pa&sporl and visa applicants. (1) aircraft pas >^nw. and r^* 
member s (4) chump frdnai and dome stir law enforcement encounter . or i'\i 'Xher appewed 
arlivfUes that liave a substantial basing on honjehliid security Thr walchli \? ■ -at quir Ids and 
arnuatrly notify thr user dial hr or she has racountaed a known o* tusper ted ferrond \ PCS Tt 
and it provides instruction on liow to respond to thr mroumrt 

(UtfFOUO) TKEX is responsible for msunrif! ah subjects of FBI terrorism trr,r-,ti ga zkmh are 
appropriately nominated to, and/or removed ftom, (he TSDB and all eligible ^^por&crg .stems 
TREX also ensures that records in the TSDB and supporting systems are modi bed as 
appropriate A nomination is accomplished through the submission of a watchhst Dcemnanon 
modification, or removal to TKLX (refer to iT-scr nun 1 ! f< of this PG) 

11,1.1. (U) The Terrorist Screening C enter 

(U//FOUO) The TSC was established in 2003 by l iom riaad Seruj m_ Presidential DaxchtT 6 
(HSPD-fi). which directed die establishment of m otg&azmaa that would consolidate die 
government s approach to terrorism screening and provide few the appr .ipnaie and lawful use -jf 
terrorist in formal] on in screening processes The TSC is a multiagency entity admaniittled by the 
FBL w ith the mission of facilitating and assisting in the protection a earns* terrorism bv 

* (U//BOUOJ C ocLSohdatmg the USG s approach to terrorism screening 

* (U//FOUO) Providing for the appropriate and lawful use of terronM identity tnibcinaiicn 
m screening processes 

* (U//FOUO) Maintaining consolidated thorough accurate and cunni mfonnatiun on 
tertemst identities 

* (U//FOUO) Sharing information global Jv and berween die federal nie local territorial 
and tribal law enforcement and intelligence communing 

* (U//FQUG) Conducting these activities tn a manner consistent with (he U S. C onsdUAOD 
and applicable U 5 laws protecting privacy and cud hlsemcs 

(U'TOUO) To ensure die TSDB contains the most thoroueh. accurate ant rurau mionnabca 
TSC personnel review mdividual TSDB records throughout the waJtchkstmg pr ocess in * Judins 
but nor limited to at die tune of nocmataon and or modification. at the time of a verreutng 
encounter w itli a w atclthsted subject, and at die tune a watchhsted subject submits a redress 
inquiry widi a screening agency 


SECRET >OFORN 


SI ( Kt I tfNOl i>|iis 
(II) 1 ininlnleiiiwistn Poliry (Rude 


(tl'TPOUO) The I'SC irrrivr* iMiffi ttfKSTl ficmi (in- following two mmim (1 J du* 

NCTt regarding inlrm tin nut tmuviista ami { ■) diuvlly fiwti (be Fill irgaidnig dnttiralir 
tdronUl Identifier* mu link* bmp aplm al mliHiiunnn such m iltfe dibit di 0 X >11) |iU r of bn th 
SSN m btamrtm information hutIi as plnHogi afi4v^ c* lmgerp«intK The idmlifins of vtMpGCted 
trminsts m dir TSUB »t ilmtirti Fa Offer*] Uie Only (FOOD) and *ie fa watt hbMiiig 
purposes only 

112. (IT) Civil LEbcttfo 

(U/^FOUO) To iworrrt civil libcii>r\ and pnsucy rvriy watt Misting noumuluni mtiffl mrtl the 
wauhhstmg standard (refer to *ulbM*vtion 1 M of tins. PG) The watckliltlfig of individuals based 
solely oti admires protected by the First Anmdmrnl , on Ok tare ethnicity national chi pm m 
rrhpifm of the stib|nl in for political on irtilulory puijioses is prohibited Any piopnsed 
nomuiatitin foe watch! islmp tint involves a MM (refer to liir I) UK i section on sensitive 
investigative matters) will he hnrugjM to tlic attention of TSG { ID OGC and DOJ officials as 
apptofmate FBI personnel must stmr to ensure that the data submitted is accurate liturmipji 
and rtutnii Also personnel musi ensure waiddist reroute are updated on a timely basis to limit 
any potential adverse consequences to wale Misted individuals and to reduce the potential for 
M&daiii&aticd 

1121. (IT I'SPI R Status 

(UATOUO) A subject s US PER status does not prevent the subject's nomination Foi entry into 
the TSDB In accordance with the TSC s ft eh ksrmg Guidance . March 'OH § 3 15. 

noniuiatiom of U5PER statist be made based on mfomiairmi of known lehabditv or wliere there 
exists additional corroboration or context supporting reasonable mspicion To meet these 
requirements all FBI nominations are reviewed by TREX and TSC which confirm that the 
watchiisUnp standard has been met While TSDB includes USPER subjects, US PER status may 
affect a subject s export to a particular supported system 

1 LJ. (U) H ak hinting Standard 

(TFOCO) In order to nominate a sub] eel for entry uito die TSDB and all eligible supported 
systems the FBI mast have a reasonable suspicion to believe that the subject is a KST w an 
authorized exception To meet this standard the FBI must have articulable intelligence or 
infoimanon which, based on the totality of the facts, and taken together with rational inferences 
from those facts reasonably warrants a detemnnahon dial die subject is known or is suspected to 
be lot has been) knowingly engaged m conduct constituting in preparation for. in aid o£ oi 
related to. terrorism or terrorist activities There must be an objective, factual basis for the 
nominator to believe that die individual is a KST M«e guesses or hunches are not enough to 
constitute a reasonable suspicion that an nidi vidua! is a KST For additional detailed mfomiatiofi 
on the watcldisting standard, refer to (he TSC s Walchhimt^ Gw Jtmcr.. March JO/i or its 
successor 

{U FOUO) Tbe DIQG authorizes the lmualion of a PI based on anv allegation or information 
indicative of criminal acnvitv or threats to national security In order for PI subjects to be 
w at dibs tad the allegation or information used to predicate die investigation must also men the 
reasonable suspicion st andai d for w atcldisting The DIOG udunzn die initiation of a full 
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sm if i ttfmn 

(U) ( sna*rrirtimmnM*y1*&lr 


trivr'ihgjAifjti l*»rd irti 4ti ail* *daMe farina! taM* *#f pr*Wj4r rm.uuJ Mid ru&mn I titers* 
hv IiviI v Hit artjruUldr farttiaJ bum m+d to <jp*» * tntrMrmn fafl k*” ititt* 

rrasmuMr siwspi* win standard fur wte/Jih sting. 

(U//FOIJO) Sidu|rrt* o f f 1**0 dun Mirvnjfirii mt tmd u* lr ydrf/unH to 1 F X few w^bhsfcnf, 
nut may terrorist t* orgam/ahwi name* Ite fmxwMtd for rt*y mta far TSCrfi 

N< rfTinulifflis m ay not br bavd uu vjw < r irportrug dmnM iwHIufcfo Sunproof* arte*te? $mr 
that don not n«r to the IrvrJ of a reasonAlr vjHpv nm <* Mi mM t**t/r*i nutphtm t mi a 
luffioot liasis u> watchltft aii individual The niijr* tivr firtua) basis JnAj»pr a iperifr 
individual to tenanted or tertmist artrwiM* mjIw known at palirutsTOM) tier ogaterr 
mfoirnaUnri wlrn h is lite bw» I en adding thr subvert of « FBI nzvrteijpfic*) to Ap TSfJB 


(U//FOUO) III malting a i raw liable sHptridii drtmTmnzbfMi lb* FBI mav t brh^wji 
indicators known to br associated wrth parting* known m mMfVfird teworitei m the part TV 
nred to protect civil bberiio however fequuri dial uadi mtValan w* V pdgrd ■* fsedteutei 
Each indicator must br viewed m the route** m which (t occur* and r ooadrfcd id comknsjfcriB 
with ail oilier known it jfuf matron to iwm e that any oommaDoo based a wbetir « m part cw *» 
bdiavior comport** with thr standaftk set forth above fixampk'i of some sustnf bc havw rte 
indicators include 


• (U//FOOO) Attendance at training cangw known to thr USX m fi i1<lit| terrorist 
activities 


• fU^/FOUO) Attendance At schools. mstitutRiris idruiiftrd fas thr T SK *■ irachrrir exff*!*wf 
ideology including dir juaifitiUon of thr unlawful use of violence ot Kdate etktnm 

* (U^/FOUO) Repealed cotitan with indmduals idrntofird bs 4r 5 SK ja le-adnof « 
espousing ideolofv that me Judrs thr juitific Mum of the unlawful u*r of vtoknrr or woiot 
eadiamsn 


* (L’/ TOUO) Travel for no known Lawful or frratmuuc purpcrtr id a 

actisitv 

(LVTOUO) AddititmaJ guidance aud specific m\ rvtigalioo ex anyt e v for thr 

standard can be found on the TREX Ipir a art star and on ihr TSC 


11.1.1. (IT) Eireplkw'i 

(LWOUO) The National Sreunts Council has approved irverai instances m whach an bAi^ 
who does not nieel the reasonable suspiooo siaodaid mav br animated Id socar of thr TSDB s 
supported synnns r refer to the TSC's Mar:^ ,‘fr. - j 1 14- Ageafc 

must cooidinaie with TREX to drtmruite if a aveu individual talk within the hi s«s of onr of 
these exceptions 

1 1.4. (U) TSDB and Suppnfted Ss sleHK 

(U TOUOj: The TSDB supports federal state local termonal. and *i taJ jLasv*niies ao d i&zam 
foreign gosemmeuts efforts to screen for KSTs through us exports These zgtonfei use iha 
svviem* to nm name checks against TSDB data The T5C rrfulMlv ptm ides i^dated 3ul'ri*e»> of 
TSDB dau to se\ «al svstwns 
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si < HI l//rsioi(iHN 

(11)* iHuilntnitiimn PdlO (iimlr 


114 1 (l UM (!| K linn n hi Sus|»ri liil I *1 hh IM I ih (KM I ilr| 

(I ^ Hit ks I filr 1 % maintained K lhr TSt and homed within Lhr NC1C datafaaar lhr KST filr 
is rimfiwd of mlnrmalKin iditrd in the ulrtthiic* t»f mdivuliuh known in nmprtlrtf in havr 
kmmniflv neaped In inridibii * 1 instituting fnt in aid of in tfUtrd In 111 lc 1 rLJlMn 1 . 1 l in 

domestic trnocum « Imiiiil acbvieci 

(1 KJUO) Suit IV KST filr w m farmnly known u Ilir Violent Gag uni Tenantf 

F ilr (VtTTOF) thr VCrTDF was iplil utfo two wpaiatr filn m AitpuM 

>009 the Gmft tik and (Air KST life 

114 11 (l KH'OJ KM llandtme < od*i 

(l TROUO) 1 j« h irr«il in lhr KST filr must be asiipifil a handling < ode as follows 

11 41.1 L (l > Handling Code 1 

(1 FOUG) Handling ( odr l is ft* mdiv iduaU foi whom there is an active frdmal anrsi wan ant 
in die NCK" Wakd Rfirsnm Ftle The wan art rnimhn must br nu liulnl within the waarhhsi 
irqnesi If a subject ts walrhhsird with Handling Codr 1 and lhr arrest warrant becomes invalid 
dir our it'cnl must submit a new watdihst request form to 1R E X (o itfiniate lhr record Thr 
fidknrmg banner apprais in thr KST filr wlwtt a Handbag C ode 1 is enrotjnkird 
‘••LAW ENFORCEMENT SENSITIVE INFORMATION "• 

WARNING APPROACH WITH CAUTION 

THIS INDIVIDUAL 15 ASSOCIATED WITH TERRORISM AND IS THE SUBJECT OF AN 
ARREST WARRANT ALTHOUGH THE WARRANT MAY NOT BE RETRIEVABLE VIA 
THE SEARCHED IDENTIFIERS IF AN ARREST WARRANT FOR THE INDIVIDUAL IS 
RETURNED IN YOUR SEARCH OF NC1C, DETAIN THE INDIVIDUAL PURSUANT TO 
YGUR DEPARTMENTS PROCEDURES FOR HANDLING AN OUTSTANDING 
WARRANT. AND IMMEDIATELY CONTACT THE TERRORIST SCREENING CENTER 
fHQ AT 

(MS) JPJ-W0! FOR ADDITIONAL DIRECTION 

IF AN ARREST WARRANT FOR THE INDIVIDUAL IS NOT RETURNED USE CAUTION 
AND IMMEDIATELY CONTACT THE TSC AT fStSA) *72 9001 FOR ADDITIONAL 
DIRECTION WTTHOirr OTHERWISE EXTENDING THE SCOPE OR DURATION OF THE 
ENCOUNTER. IF YOU ARE A BORDER PATROL OFFICER IMMEDIATELY CALL THE 
NTC 

UN AUTHORIZED DISCLOSURE OF TERRORIST WATCHLIST INFORMATION IS 
PROHIBITED DO NOT ADVISE THIS INDIVIDUAL THAT THEY MAY BE ON A 
TERRORIST WATCHUST INFORMATION THAT THIS INDIVIDUAL MAY BE ON A 
TERRORIST WATCHUST IS PROPERTY OF THE TSC AND IS A FEDERAL RECORD 
PROVIDED TO YOUR AGENCY THAT MAY NOT BE DISSEMINATED OR USED IN ANY 
PROi f ELHNG WITHOUT THE ADVANCE AUTHORIZATION OF THE TSC 

‘"LAW ENFORCEMENT SENSITIVE INFORMATION"* 

(l FODOl Whenever a Handling Code 1 suhfect n arresird lhr case agent must modify thr 
KS'FNCK neon! lo change Handling C ode I to Handling Code l 

11 4 I 12 
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I *1 TffMtffMr* 

(U) f N» ¥ ^ i"*»dr 


(li//l C>UO) H*)dlinp C «k ? » Cor wirtviA^* fr* whrjm HU Its m mfi 4 

iJrUfiin if thr indfvi^u) i* rtjrowitrfrd by bwenfrirf rmntf \* r>wv *|v ^ <•+** < * *r«\t 
fin wtbrJVTJ these I* 4 tafed aiN Wj*T»M ilffir If It'jwrwf to hs^r w^rr^ ,>«rf 

Ui mJiw if lil I I V } A jrvmt of if JlrUiRnr * r irrwrifc Xinaf (wnrr|p .^«W»virf. 7 -f*4r 
mtodte KSJ Mr witfi ihas hsutlwip f wlr lo utf Hiidlif * '*V * ^ *** w*J km 

tu&ifiicy by bodl tbr <7X aod teOCC *t trqiM«l Tin? !V Ijwltii ir, 
coordmabon with tlir NSf J1 will pmde wrfa approval l«f fV ****** 4^^ 

in dir KS1 filr vdiru 4 f Landtinp C«fr 2 it r**m*ilwed 

“LAW BfPDROMEKT SeWSlTlVF INFORMATION'** 


WARNING APPROACH WITH C JWTION 

THIS INDIVIDUAL IS OF OTV EYUGAim WfTEBXST TO LAW FNHJP' ' ’ 
REGARDING ASSOCIATION WITH TERRORISM AND THERE MAT »■ A 0E7APM 
AVAILABLE FROM THE DEPARTMENT OF HDAffLANTJ SFTUTTTT Kf THIS 
INDIVIDUAL 

IMMEDIATELY CONTACT THE TERRORIST SCREENING CENTER fTK) AT 
fS66; I7TW0! OR IF YOU ARF A BORDER PATROL OEFICO MdUmi CALL 
THE NIC TO ASCERTAIN IF A DETAINER JS AVAILABLE FOR Tiff IttDfVBDLAL AJ® 
TO OBTAIN ADDITIONAL DIRECTION PHASE gCESTO-i TKB BOTVTDLAL TO 
ASSIST THE TK IN DETERMINING WHITHER THE ENDTvTOC’Al FNCOL'NTERfD B 
THE SUBJECT OF A DETAINER WITHOUT OTHERWISE EXTENDING THE SCORE 0* 
DURATION OF THE ENCOUNTER 


UNAUTHORIZED DISCLOSURE OF TERRORIST WATCHLBT INFORMATION O 
PROHIBITED DO NOT ADVISE THIS INDIVIDUAL THAT THEY MAY « Of* A 
TERRORIST WATCHHST INFORMATION THAT THIS INIXVTDLA1 MAY BE ON A 
TERRORIST WATCHUST IS PROPERTY OF THE T5C AND IS A FEDERAL RECORD 
PROVIDED TO YOUR AGENCY THAT MAY NOT BE PRSEMKATSHB USED V AWY 
PROCEEDING WITHOUT THE ADVAICE AUTHORIZATION OF THE TSC 

■**LAW ENFORCEMENT SENSITIVE INFORMATION *’* 


1 14 1 . 1 . 3 . <U) Handling c «d# 3 

(U TOUO) Handling Code 3 h for mdrviiktab wito tovr bn rufcihii^rd *wi io mrer *r 
additional aim is for Handling Codr I or 2 These records «M*t canm a firv oxir ■ uieif 
,md year of birth * The following banner ^pran. m the KST file wires a Haodbug Codr I « 

encountered 


•‘•LAW ENFORCEMENT SENSITIVE ISFORMATOff^* 

DO NOT ADVISE THIS TNDTVTDUAL TELAT THEY MAY BE ON A TERRORIST 
WATCHUST 

CONTACT THE TERRORIST SCREENING CENTER TST AT ! «•»; DURING 

THIS ENTOL T NTER IF THIS WOiLD EXTEND THE SCOPE OR IR.TL4TTON OF THE 
ENC GCJWTElt CONTACT THE TSC IMMEDIATELY THEREAFTER IF Y(r ARE * 
BORDER PATROL OFFICER FUMED LATELY CALL T1 ft NTC 



with TREX 
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SIX Kl I7/NPIOKN 
(II) < kunkrlniaidii Pobcy think 


ATTEMTI Itl OBTAIN SUFFICIENT IDENTIFYING INFORMATION DURING THE 
FNl’tUPNTHR WITHOUT OTHFRWLSF EXTENDING 1111’ STOP! OR DURATION OF 
im ENCOUNTER ID ASSIST fill I SC IN DETER MINING WHETHER OK NOT THE 
NAME OR IDENTIFIERfS) YOU QUERIED HEIONOS TO AN INDIVIDUAL IDENTIFIED 
AS HA VINCI POSSIBLE TIES WITH TFRROK1SM 

DON ITT DETAIN OR ARRI ST THIS INDIVIDUAL UNLESS THERE IS EVlMNCIi OF A 
VIQt A DON OT EFDERAL STATE OR LOCAL STATUTES 

UNAUTHORIZED DISCLOSURE IS PROHIBITED 

INFORMATION THAT TIBS INDIVIDUAL MAY BE ON A TERRORIST WATCIfUST IS 
THE PROPERTY OF THE TSC AND IS A FEDERAL RECORD PROVIDED TO YOUR 
AGENCY ONLY FOR INTE LLIGENCE AND LEAD PURPOSES THIS RECORD AND ANY 
INFORMATION CONTAINED WITHIN IT MAY NOT BE DISCLOSED OR USED IN ANY 
PROCEEDING WITHOUT 1HF ADVANCE AUTHORIZATION OF THE TSC 

WARNING APPROACH WITH CAUTION 
■"LAW ENFORCEMENT SENSITIVE INFORMATION*** 

11.4 1. 14 (U) Handling Code 4 

(U//FOUO) Handling Cock 4 u fot individuals who have been designated Military Retainers 
(MILDETs) These mdm duals have been vetted by die Department of Defense (DOD) as 
persons detained by Coalition Etwees m Afghanistan. baq tn Ciiiattianartio Hay and have been 
si i own to have no known nexus to terrorism These records must contain a first name. last name, 
and Yew of birth The following banner appears when a Handling C otie 4 is encountered! 

*■ 'MESSAGE KEY QWT SEARCHES ALL NCIC PERSONS FILES WITHOUT 
LIMITATIONS 

*"LAW ENFORCEMENT SENSITIVE INFORMATION*** 

DO NOT A DVTSE THIS INDIVIDUAL THAT THEY MAY BE CONSIDERED A PERSON 
WHO MAY POSE A THREAT TO NATIONAL SECURITY 

CONTACT THE FEDERAL BUREAU OF INVESTIGATION (FBI) AT (866) 872-9001 
DURING THIS ENCOUNTER IF THIS WOULD EXTEND THE SCOPE OR DURATION OF 
THE ENCOUNTER, CONTACT THE FBI IMMEDIATELY THEREAFTER IF YOU ARE A 
BORDER PATROL OFFICER IMMEDIATELY CALL THE NTC 

ATTEMPT TO OBTAIN SUFFICIENT IDENTIFYING INFORMATION DURING THE 
ENCOUNTER 'ATT HOLT OTHERWISE EXTENDING THE SCOPE OR DURATION OF 
THE ENCOUNTER TO ASSIST THE FBI IN DETERMING WHETHER OR NOT THE NAME 
OR IDENTIHER(S) YOU QUERIED BELONGS TO AN INDIVIDUAL IDENTIFIED AS A 
FORMER MILITARY DETAINEE 

DO NOT DETAIN OR ARREST THIS INDIVIDUAL UNLESS THERE IS EVIDENCE OF A 
VIOLATION OF FEDERAL STATE OR LOC AL STATUTE^ 

UNAUTHORIZED DISCLOSURE IS PROHIBITED 

INFORMATION THAT THIS INDIVIDUAL MAY BE A PERSON WHO MAY POSE A 
THREAT TO NATIONAL SECURITY IS THE PROPERTY OF THE FBI AND IS A FEDERAL 
RECORD PROVIDED TO YOUR AGENCY ONLY FOR INTELLIGENCE AND LEAD 
PURPOSES THIS RECORD AND ANY INFORMATION CONTAINED WITHIN FT MAY 
NOT BE DISCLOSED OR USED IN ANY PROCEEDING WITHOLY THE ADVANCE 
AUTHORIZATION OF THE FBI 
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si r Kt twwtm* 

(U) C txiiHrt trf f Of IW) Mil V t fit «dr 

wafnjwg aptow'h wrnf rAi/noM 

♦••law mtmtmmm mmmnvE wmomATw* 

1 1 4 I I, (l) Silrnl IIH ^diiunttkm^ 

(S//NF) ftjvestigainis may nurit 4 w^jert t ICST file rrili y m sdena wbu h will pF*v*fli jpy 
NCI( queiy fiom ffturrung a KST rerord for example *f a t^jtar traffic dap ke J ur* 
rriftm njifTii (poia a subjects rwrr diM bat been identified a* a siln* hit lir oflkei will 
receive all ruminal records foi dir subject ilm arr in MC K bm will out be notified tha tCae 
subject is a suspected 1efion«t lb c*d« to oiler a subject £ rerord s a wlrni hil (hr iMUtoting 
official must ulinijatr a specific nariowly defurd and lejotifiErte operational fustob'j&xMi 
Possible justification* for a sdenl hil /with the requisite written jrtrruLflioru (tt*Y mrludr the 
following 

* (StfNF) Hie subject of the investigation is die target of 24-hourv a dry seven dav> a 
week (24/7) physical surveillance undercover activities and aprr jKota and or etsejiive 
source opeiations 

* (S//NF ) Ilir subvert is an employee of a maxfrt of of affiliated with a fiikiry federal 
state , local or othrr law enforcement agency or any poup that may has*- acres? to NCIC 
terminals 

* (S//NF) Other unique operational ctrcumsuaces in which a noromatme official * 
articulate a reasonable and detailed justification whv the subbed needs to be included u a 
silent )wt 

(UATOUO) Because a silmi hit raises officer safety issues subjects who ace violna or are 
known to be armed and dangerous may not be marked as silent hits 

(U//FOUO) Other than at a primary screening by CBP and m NCTC marked as sikal 

hits are not silent m any other walchlisfing -supported systems Requests fee Client tuts drag a 
secondary screening by CBP can be coordinated on m imesbgatioo-by oivestigairai baas for 
CSPERy ihrough the TSC (refer to subsection 114 6 1 for further mformstwo ) 

1 1 4.2. (I ) General f i a importation S« ui in. Atlminrh ation iTS A \ W atf hli tmg 
Guidelines 

(U 'TOUO) The vvatrhlurtmg community has developed £ne general gmdebnn regarding the 
inclusion of an individual on die TSA s No Flv and Selectee Lists d»i are necessary to 
effectively implement the No Fly List and Seieclce List criteria 

(U) The five general guidelines are 4 


* (U) Hus section contains Sensitive Secuntv Iniormition SSJ tint u codrohed nnda 4$ CTO. Puts It mA 152$ 
No part of this material nuv be- disclosed to pet soiii *uk»ut ■ need to leant m ae£afd ta 4* CTOFwst 15 m& 

I 520. recfpt with die ivntren pemusuon o( the .Adanmstenof of da TmtsporUELai Secwfiv ^ saaz^nzuvi : : t^r 
Sec letaji of TnmsportitLQn L atuibonzed release mat cesult m aviJ pesaltv on odm arfiem. For USG west :fs 
F hUr disdoture is governed by 5 V S C J 352 and 49 CFF Pwti 15 and 112$ 
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SKHII7/MOFORN 
(U) Qum q tenaum Policy Guide 


t (U- NSI) Whm r\ all utu ip. the RipmFiranrr. irlevancr and validity of a thus* careful 

coti&i delation should hr given to the extent to which die threat is run oil, specific and 
credible 

2 (U Ssft TV Select ce List is not a default position fm those who do not qualify for 
inclusion on the No Fly last and has distinct clemmLs tint must V met before an 
individual may V included 

1 {\ r SSt) IV purpose of the No Fly last is to protect .igamsi arts of tarafiam, inclusion 

on ihr No Fly List has consequences that are opnatunial, legal economic and 
diplomatic 

4 (U SSI) Except for expedited nominations in arcoi dance with walriilistmp guidance, the 
decision to include a person on the No Fly List m Selectee List must include substantive 
derogatory infonmtion {refer to subsecti ons 11.4 ^ and I L I “l of dm PG) dial satisfies 
the entena and justifies inclusion cm eitlia list In investigations where nominations 
contain no substantive derogatory information oi contain insufficient substantive 
derogatory information or insufficient identifying atiena, die individual will not be 
included on either the No Fly List or Selectee last 

s (U'VSSQ In accordance with walddistmg guidance, the White House may on a temporary 
basis, direct the TSC to place categories of individuals who do not nlecl the established 
entena on die No Fly List or the Selectee List when necessitated by exigent 
circumstances, in response to credible intelligence information or a particular ducat 
stream 

6 (L ' SSI) Under exigent operational circumstances when derogatory information nsay uol 
be widely disseminated or stored in TIDE individual watclihst status deteimwatious can 
be made by die Director of the TSC. m accordance with die relevant criteria 

11.4.3. (V) T5A No Flv List 

(U TOGO) The TSANo Flv Last is intended to pres ent potential terrorists from boarding any 
commercial aircraft traveling within, to or through U.S airspace, or from boarding any U 5 flag 
earner regardless of origination or destination Inclusion does not provide grounds for arrest, 
detention seizure of property' or documents or referral to a foreign government for comparable 
action Inclusion also does not alter dir fundamental right of U.S citizens to return to the United 
States FBI employees may not state Of imply to watclihsted individuals tbit then ability to board 
an .-urciaft or letwiy^h^Uiutg^iair^^oimiigeut upon then cooperation with the FBI oi 

|U SSL Individuals. regardless of citizenslup who pose any of die following tin eats, may be 
placed on the TSA No Fly List 

• (U SST) A threat of committing an act of international terrorism oa domestic 

terrorism «as defined ui IS U S C § 2311), widi respect to an aircraft (including a threat 
of an puaev or a threat to airline passengei or cml aviation security ), or 
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• (1J//SSI) A tlurai of ronmfttjritf art of dnmrvtt* tmon^rt (m drifted m I < r > < , 

2131 ( 5 )). With ffspetl to tlr htnYirLerd « 

• (U//55I) A dural of committing an art of inter nati- rial tmorivm <» defined m 3 f 
USC § 2331(1)) against any USG facility abroad and associated of 

personnel, mrlndmp U S rmbassie* consulalci and mission* military installations fas 
defined by IOUSC $ 28m(c)H)j U S ships, U 5 an ctafi or other aujuiswy craft 
ownrd or leased by tlie t JSG r or 

• (U//SSI) A threat of conducting of engaging in a violent act of terrorism and who is 
operationally capable of doing so 

(U^/SSf) An individual is operationally capable if based oo credible intelligence be or she 
M m lmp individually or in concert With others reasonably appears to the ability knowledge 
opportunity and in lent or is actively seeking the opportunity to engage m a violent act of 
terrorism, comistent with 18 U S C § 2131 or 1ft U S C % 2332b For example a&rn**inv to 
obtain an improvised explosive device (IED) would indicate an individual a operationally 
capable of committing aai act of terrorism Howev er struply cooducirng research concom^ 
lEDs would not alone be sufficient without additional activity Impending on ciftumsiances and 
m combination with other facts scouting potential targets or traveling for no le&tgnactr purpose 
to places that have terrorist training grounds regardless of whether the person is presently 
capable of using an IED might also indicate an individual is operanonaHy capable of omiTdjmu>:? 
an act of terror ism. 

(U//SSI) In deteniumng whether an individual is operationally capable consideration should 
be given to die following possible indicators regarding ability knowledge opportunity and or 
intent 

* (LV/SSl) The subject has under pone terrorist training or been provided some ratruettan. 
including receiving military training by a designated terror ism group 

- (WSSI) Tlie subject has indicated his or hei intent to participate m planning or cooduetm? 

an attack, 

* (Uf/SSl) Tlie subject has expressed a desire to marni himself or herself 

* (U//SSI) The subject is in repeated contact with a known terrorist facilitator who recuHt- or 
facilitates travel of operatives 

* (U//SS0 Tlie subject is planning an attack either alone or as part of a group car 

* (U SSfi Tlie subject is associated with a terrorist group or cell and is ac enmuiafm ? 
weapons oi explosives 

(U//FOUO) Generally in order to be me hided on the No FJvor Selectee List ( detailed below 
nvo precouditions must both be met 

1 (U TOU01 Minimum identifying biographic entena rocsistmg of firs name last name 
and full date of birth aie tequued 

2 (U TODD) Minimum substantive derogatory criteria for inclusion most be met 
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(t,f) I ivmlii IriitM 1*1111 ISihry Ctimlr 

(1 ) OUO) I invijH t»S Unr il tnfoiti»huri nun tug tin* * niru-i detctihed above the unped 

I HI CAST ignit m 1 MXindUtiOft with t 'ID must determine whethei (hr subf« l| i) uf the 
mvrstigauoN qualifies for die No Fly Lot If (Ih* uw agcni tlrtmnmr* that the i qualifies 
tl* wall hlist truest must be «ubttitlfc-d in ItthX withm 24 hciuni of nu b a drinmuuliovi \^iA 
subject matin rxpnis awgtw-d id tfar TSC review at l onruinatiuns to llir No My Iasi and JIM! 
Hia> deny a sublet! s addition os removal fiimi tlir list if it is drlrmnned tlr individual doei not 
nmrl llir above ( nlma 

II 4 * {I TO! TO) TSA H*k>rl*e Lid 

(I- SHU IV TSA Selectee ! is! is intended to pit- mu a jxHnibal tamxint hum pa«*tns *rougb a 
ISA rberlqmini without i reaving a BCCOOllar V screening llie screening offered by selectee 
sfatui is solely tn search for weapons and other dangerous items pnoi to boarding an attoaA ti is 
not a search dcsijtujcd to (pun additional infhnrcaiirvn through poc kei litter addiess lwxiks and dir 
like An uidmdna] who does not me*! the ortena fm inclusion no ihe No My List legardless of 
nti/nisiup may be listed as a THA selectee if die mdi vidua] is both s 

\ (U SSI> A member of a foreign or domestic timmst organization (including a foreign 
ten on si organaalion designated pursuant to statute or executive or dei) 

2 (U SSD Associated with ten oust activity (as such lenu is defined id subsection 
2 X 2(aX ?KB) of die InmiiiTi alum and Nationality Art [BUSC II &2(aX3)(B)]}. unless 
mfoiuuhon exists that demonstrates thai the .implication of a secondary screening to such 
a person is not necessary m which case such persons may be excluded &om the Selectee 
List 

(U TOUQ) Subject mattei experts assigned to the TSC determine if individuals nominated as 
selectors meet the entnu for tins bst TSA personnel regularly review selectees and may 
upgrade or remove a subject fiom ibe Selectee List if current intelligence shows that the subject 
ettiiei meets eu does not meet criteria l and 2, as listed above TSC andor T RF. X will notify the 
case agent of any changes lo ihe selrctee status of die subject 

(V TOCO) The mmummi biographical information needed to nominate an individual to die 
Selectee List is the first name last name and full date of birth 

114 ? (I TOl O) C onsulaj Lookout and Support System (C LASS) 

(V TOCO) Subjects may be included in tlie DOS s CLASS database CLASS ha* f wo 
subsystems CLASS- Visa and CLASS Passport CLASS- Visa is used by DOS to screen non 
USPERs applying for visas to enter the United States (USPERs are not included in C LASS 
Visa) CLASS Passport is used by DOS to screen USPERs applying for US passports 

1 1 4 0. (I TOl O) TEC S Syntem 

(U TOUO) Individuals may be included ui the DHS TECS system, which serv es as tlie primary 
iniefijated lookout system currently available at U S ports of entry DHS uses TECS to screen 


*jfL : > f<w ■dditiofwl inferos ban. pl«*e TSC s !?0n ’A'aictJ.ivi Guitbuce, 1 1 U 2 
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berth UKPkKn and twm C/K|*V9C» t Wf J itoprUnr* quny N * S whn Hi indtind - 
tin* L Truied Mates 

114 6 I ilWhWX) msdni lltf) 

(Uf/LES) For ofjffabaiai omk, tour « an ex* luatro rink in IT/ ' rJkd j 17 1>Mnr* Hrf ; tta* 
t an be pbu ed on a KST lerjotd fur a pirwmgrr who malriirt aj^ynsf 7Sf>B Use of thr. r r*k 
will make tin* wadihlivl in formal ion invisible in xf.BP office* 4 fhr port of y 1 KM Ftnvyjf 
and thus prrvmt lli*' pa^sr-ngri a ?rfnr*( k» v^mmiMy wrrening To dewf^ufle a teheed for a 
silent hit. T St ■ may advise i hr taw ajjfnt dtuitip; dir mrouniff nmpinr pr*j*j^» of ffir T7 
drsignalni and its ciitnia and sedk fqn ujrnx* from (hr cjst jffrnf to t~ ini4f fhr vrbjr^F j& a 
T7 Lf ll hr cane apriil agrees the ayrrri will be required to coor^trhr m f [> j Id ratdrfv Ar 
sulnjrti s watch! ist slalm After thr subject has htm changed to a T7 dv TSC will C BP 

via rstablislu-d c JianurU of thr walrhksl sfcttiu r lunpr Thr mlnta for dr**gn£t»0 « of * 

passman as a T7 Hr 


■ (U^/liiS) Br thr current rubjrrt of an FBI r ouncmm 


* (U^/LES>hnotoonihrjtfr TSANoFlyor dir ISA Sdmre b*ta 


* (U//LLS) Not hr flagged in NOC » 'Aimed and Daneerow tokot T« 

Explosives Expertise .' 1 ‘Suicidal or Martial Arts Experts 

* (U//LES) Dors not pose a thirH to office safety 

* (UtfLES) Br a Uurted Stairs Pmoo (U5PER) 

11,4.7. (T7/FOI O) TTPOFF I nitrd Slates { au da fTrSCAN) 


(U/^FOUO) Noo USPER investigative subjects. may be entered into IT SCAN a program bawd 
on a l-nited States C anadian agreement through which sensitive btn unclassified hvo^rapbic 
lookout data elements on a subject air shared with the C anadian gmemftier* Der™**> 
information is also transferred to the C auduri gcnetmunn on m iDverogatJoci- Ar» ur. estiotaon 
basts Canadian citizens are not included m TUSCAN USPERs mr not included « TLNC AN 
unless they are on the No Fly or Selectee Lists or have an active federal arrest warrant 


11.4 8. (U//FOIO) T1POIT Australian C tmmei temm id In forma I hu Cnti^l Sv 

(TACTICS) 


(U'TOUO) Non-LFSPER invesiigatn r subjects may he entered iran TACTK S i pr o&am bawd 
on a United Stales Australian agreement through which sensitive bm undassified bio^r^ikac 
lookout data elements on the subject aie shared wTth the Australian gcnTEnsmt Oernfalory 
mfotmation is also transferred to the Australian goverament an an wvrcftgabdp bv m'. estimation 
basis Australian citizens and permanent resideais from Australia with the moeptusi of those 
who hold dual LT S citizenship are nududed in TACTIC'S L'SPEJLs are nor mthided b 
TACTIC S unless they are on the No Flv oc Srlretec Lists or have m acme federal attest 
warrant 
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1 1 .4.9 (!’) Additional Hii|ipoited 

(U warn) Ihe TSC though the INDR also makrs Irmmsl identifim aCOCuAle In irtltrt 
ratifies il trough dir icjnil.u export el Updated subsets oftSDIl daia These include 

* (1 TOl FO) Other vuppoitid databases Tlw T SC also provide, die FBI arid certain 
odin federal -mthontirs wiLh access to TSDB infoniutaun fin sir retting of analytic al 
puqKrses This may mrludr * rns to die FBFs centra) irrmdfcrrpiiip. system flic FTTTF 
tUutiAsc ami the TSA s Office of tiaaispcmatiDti Threat Assessment database 

• (I F Ot JO) ( return foreign |oi vrMB*pta» The TSC pr ovules a subset of the TSDB lo 
certain foreign partners in exrlianpr for their Irnottsm screening information 

1 1.5. (T) CTD Nomination Potiev 

(V 'TOUO) Case agents must submit ualrhlist nominations to TKFX for all subjects of 266 ot 
41 % investigations m accordance with vibsecluui l i 6 with die exception of uivrstipatitjcis 
predicated on a victim, organization. artrvitv of comparable unidentified entity for which 
walddisiuig is ineffective Subjects of other C YD -managed investigative classifications should 
generally be reclassified to 266 of 4 1 5 investigations if therr is reason to believe the subjects 
meet the watcblistmg standard (lefn to subse ction 1131 Predicated C"T subjects not opened as 
266 of 41$ subjects may' be considered for watch! isting oti a case by case basis bill in all 
crtrumstarices must meet the watrhhst mg standard 

(U FOUO) Subject matiff cxpcrti at TREX must evaluate each nomination to ensure die 
watchkstmg standard lias been ruet and sufficient identifying infomnation is available TREX 
must notify and provide guidance to FOs by email of subjects who will not be subnutted to the 

watchhst 

1 1A (D) Watchlistiiig Submission stamlai its 

11.4.1, (IT Subject Nomina tioo 

(U FOUO)C ase agents must nominate individuals for inclusion in die TSDB as required by the 
noun run on pointy for the appbcable investigative program, by submitting a watchlist request, m 
accordance with sirhsection 1 1 7 of this PO A case agent is responsible for ensuring the request 
is yubuntfod in accordance with the timelines established herein The request must be submitted 
within three business days of the date created in FBI s central recordkeeping system to open the 
investigation Nominations will include all available subject identifiers to include photographs 
ot odirr av ailable biometric information If the subject is bring nominated to die TSA No Fly 
Lj l t tie or die must be subnutted bv the nominating official witiun 24_ hours of receipt of 
information that qualifies the subject for (lie No Fly List TREX must process No Fly List 
upgrades within 24 knur s of receipt 

(l* FOOD) If there is a determination, due to an exigent circumstance or CTDs direction dial 
the nommauon needs to be submitted mote quickly FOs must contact TREX directly by 
telephone and submit the watehlist request m accordance with suWcrjon 117 of this PG 
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(U/frOUO) Not* I" of CTOpiir^isrt id ir^d to wafcfolrsurif an m* 

is an nnerflem y sit ijyiluffi requinjig action to prevent danger to hfr Of **r v *r. 

iLinugr to piupcfty 

(Uy/POUO) DomrstK iHiorm invest! g*tior» for used m mlfUa exfreniH** *h it*- wapr*tr«afjw 
extremists and sovereign eftazrn rxtimnslN often have ndftpfifrcd ar t»ve Ib 1 1 if. law erd : '* er*rrrf 
offrrns and ilmse m positions to thrrJr NCIC for wan am Subject*. of tJwie wwti< 5 *K»» nm*a 
hr wairMritrcl but m individual may br entered mUr for KSl hk»* vim )«t mivt wdne * 
with subsfflfomi I ) 4 I ; of this PG Operational r^fi« fepidiiw w^rhlrtfcflf * ^ [fir 1/f 
subject ntvd to be coordinated between Ihr FO the fTD prop* wn mzu&nitni i*ifl and TREJC 

(U//FOUO) Wlien the FBI opens an invertigafltto aid for subject has already br^-r, waarhfcWfli bv 
another agency, a case agent must submit a watchiist oommabOD request witiwi thf ** tnum 
days of the date crewd tn the Fill s central i*cordk«fWflg svWern to open lb mwift %mm The 
lequeffit will enhance the Tenant Identities Datamarf hnsnroameat fimEj record aid ■nil 
document the FBI's investigative interest m the subject Fatlurr to wiuut the wawhlisa request 
when another agency has nominated the individual to foe TSDB could resufe tn rnncvaJ of an 
FBI subject From the watchbsr without notification to foe FBI This proem mum fo* foe 
USIC has all available information if the original nommatmg agency aortnpts to iwww* foe 
subject fioni the waicblxsi 

(U//F0UG) Note: As a brst practice if sufficient tnfomHtKto * known to report 
watcrhlisting when the investigation » opened foe watchlist tnfunr should be prepared 
and submitted at the lime foe tijvrsugauoo is opened 

(U TQUO) TREX must proem nominations w ithin li ve brae iydig of receiving foe 
waldfost request 


11A1 (I’) Subject Modification 

(U//F0UO) Aiiei for autial subnatssaon. foe noemrunne officud must update foe watchlist 
request information (e f updated dri ogatory information that may rrsuh tn a rfranpr of 
watckhstine status change m investigation biographical information. or foe noituflatgig 
officials contact information) as soon as new information becomes available Adddaooal 
identifiers must be forwarded to TREX using foe watchbs* request's mcnkfv testuie Siqmvisorv 
.vt required 10 review foe investigative file for new identifiers durtnp foe 90-dav file review &* 
all terrorism investigations Wlien adding, modifying or deleting data from a specific record, 
only foe subject s name sex. race, date of birth and new or changed information is required oo 
the watchlist request Other information that has previously been subcmnrd need nert be 
teenier ed 

(U'TOUO) Modifications may add or delerr mfumuUon from an cxivtmg record uvi rt ip^yadr 
or downgrade a subject's watdfostuig status If a mnchfiratKiii is warranted a w*ciiivtf req- je^ 
must be subnutled tn accordance with MfosecttOP 11 7 of tins PG by foe ongmatisg FO Such 
information must be submitted to TREX dp a timeh manner nn4 to exceed! flu busmen ia^ 
from the day die new information ts penalized rnlo the FBI v central irc^Ki&upiog nstoa or the 
dav tile detemunAtioa is nude to change a subject s stalus absent anv exigent ctoOtoisuncf ca 
other direction bom CIB If exigent circumstances exisl or CTD dure tv FOs most contacl 
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TUI X directly 'itj telephone -aid submit watrhhst requests in am imLmc v with ubv'i lion 1 1 / 
ofdwKi 

(U TOUO) TRICX must siilisecpiriitiv process modifications wrtfun srveii business djiy% of 
receipt a t the wairhhsl irquesl 

(U' TOUO) Modification* to iqjgiadf a subject to the TSA No My List must be submitted by tlie 
nofiiioAiiiig official within 24 bom s of meipt of rnfoiTUAtiofi that qualifies the subject fot die No 
Fly List TRJ-X musi pioress No Fly List upgrades within 24 hours of rereipl Aflci tlie aiirst of 
a Handling Code 1 subjrrl the naniuiatmg official must submit a wtffalut request to TREX 
within three h w ny « days of tlie case agent learning of die subjects arrest 

(U TOUO) If a subject wlw has been walchlislcd moves to another FO s jurisdiction tlie subject 
must cmiAin watrhlisted until the receiving office opens an investigation Unless tlie wakhttsttng 
standard is rw loup« met The closing FQ must set a lead for die receiving FO. notifying it of tin* 
subject s relocation and requesting it to open an investigation Hie receiving FO must submit a 
vvak hhst request for each subject updating the TSDB record with tlie new file number case 
went s name arid any additional identifiers (such as die subject's address and driver's license 
nnmbn) resulting from die move The i evening FO must submit the warcliiisi modification 
reqiK*si within three business days of the date created in the FBI s central recordkeeping system 
so open the investigation If the receiving FO believes an investigation is not warranted, tlie 
maner musi be referred to CTD. in accordance with subse c tion 4 L0_ of this PG 

(U TOUO} A watchhsted subjec t who moves outside the United Slates and continues to meet 
the waichlisimg standard musi remain in the TSDB as long as an FBI inveslxgahOD leruams open 

11.6.3. (V) Subject Return al 

(U TOUO) When a predicated IT or DT investigation is closed, a request for removal of any 
w .i [chits ted subjects must be submitted. absent the criteria set forth tn subsections 1110 or 
11 11 of dus PG 

(U TOUO) Upon closing an investigation (r e a PI ot a full investigation) that has a watchhsted 
subject a removal request must be subnutted in accoi dance with su bsection II 7 of this PG 
within three bastoess days of the wntten approval and notification to CTD of tlie invest! gallons 
closure The three-business day timeline starts on die closing date shown in the FBI s central 
recordkeeping system and stops when TREX receives a completed removal package 

(U TOUO) If ao exigent aratnisooKes exist or CTD directs. FQs must contact TREX directly 
via telephone and submit watchhsi requests in accordance with subsecuon til of this PG 

(L TOUO) TREX musi process removals within five business days of receiving die vvatclihst 

request 

(U TOUO | If a subject permanently moves abroad, with no known return dale to the United 
States and a determination is made to close die uwestiganoiL the FO must submit a ware Mist 
removal request to TREX as provided abov e If however, the FO or the CTD program 
management unit determines removal of the subject is not wan anted because the investigation is 
not complete and the subject continues to be reasonably suspected of being involved m tmonsm 
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tif tri roust arfjvilies thru wabhhslirtg Oversight nerds to rrsirir with th t HI Hr fa ir? 
ftfhtetfiQii Mi l rjf tin* PC and sulmit a watch list mndtfii »nm rrqrir* armotMow tin* 
individual a nonsubjecl mdefalalNl pnwt 

1 1.7. (II) \V mI< hlvA Krijtt^i Suhiru Vikiii Profft^ and (.tiufiftrr 

(U//FOUO) FO super visors Mr irsponsiMr £oc rtwurmp j w^lf filisf reqursl aod 
acc ompanying lit’ arr (1 J suluriittrd to TREX within itj*- ettabltihrdl tone & «rr. detailed m 
II l! of tins PC i (2) dir nomination p# tape ronuim sufficient derogatory 
information to establish the subject marts the watebhsting standard rad (?) the identifier, Jilted 
on dir watf hint lequesl and EC are accurate Supervisors are rerranded that dir tertoniated Xi 
day file review printout urlndcs a section whrrr SSAs rcnJifm that all watehhding idmlifim 
liave hern submitted to TREX This includes submrttmg a /PEG t Jermt ^otoj^aphi Fxperta 
( itinip) fin malted photograph of dir subject (c g , a DMV photon aph of a pficrfosjapfc from 
anothet source) 

(U//FOUO) TREX miisl review die watchhst requests to vmfy and validate all nJtuj siuos 
process any watchbst requests lo facilitate walrhhsimg if necessary 

(UtfFQLJO) All watchlist requests with thru supporting ECs must be submitted lo TREX via 
the I REX FIT 93 0 patabasr A watcMist request must be acc unnamed by a supporting H flrrdi 
an appropriate action lead to TREX to thr evrrrl of an incomplete request TREX must notify the 
FO to resubmit the missing elements) 

* (U//FOUO) IT Program: TREX mm verify and validate wairhfist mpem In «t ifary 
rued the w ate 111 is tin g standard (refer to subvert urn 11 ?] TREX will for* ajd all requests 
to NCTC for inclusion in TIDE NCTC will in tom export those identifiers that meet the 
watchkstmg standard to the TSC for inclusion in die TSDB and appropriate supported 

systems 

* (U//FOUO) DT Program TREX must verify and validate w nrhlisl ieque*iy nd wail ardv 
forward subjects who meet the watdihsrtng standard to ISC for mdusiori m the TSDB 
and appropriate supported systems If the watehhstmg standard is not met for a 
uonumtion, TREX must notify' and provide guidance to the suEnatitmc FO 

(U//FOUO) The supporting FC tmsi contain a short pUm devmpbon of the roves tigaittsn 
including die terrorist group with which the subject is associated and the t>pe of ravafvexonir 
(e g financier, facilitator trainer or operator) IT Program waTchkst requests ■. aUcbierf by 
TREX may be reviewed by anyone with access to TIDE, inducting OGA pftvooiTei The request 
imist not mclude lnfccrnatiori pertaining to FISA collection. No Foreign (NF ) or Originator 
Control (OCT dissemination controls, protect identic individual* Bank Secrecy Act 
information Suspicious Activity Report (5AR) and Currency' Transaction Report (CTR) 
information. oi m format ion obtained utilizing giand jury subpoenas Such inl ocmanon may be 
included, but clearly marked m the accompanying EC if it is necessary re vifport the 
justification for watchli sting FTS A -obtained or FISA -derived identifiers must also be portion 
marked accordingly so tliat they can be accurately tiel mealed in TIDE 
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0 1 TUI Kl) If (he supportim* di* ittitniMItmi is inH yrl wiiali/id mhi the f 111 * refill'd 

hk m rikecpiiip system Jit the Umr Ijir wati hlist IMWl l* Slltxfllllni copies filiwl lie lit* lied Ijt 
thr irqurM Tim |*I* (ill II r rtismi-h tfwnr \\ tui ilrUy »n Uir initial sulmimiuii modi In alum nt 

llXl (l 1 ) SiihjiH i Ickniirii *tmi. 

(l TOl -O) Namnutii*^ to tl w 'ISDN nunt iiactudr 
I (IT) 1 j m name 
AND 

? (U) thie m mot* of following 


* First naror 

* {. "ouiplete da tr of bit th 

* Passport numl** 

* Alien trgisH ah on number 

* Visa mmibn 


* Sucnl security iiunihri 

* Othn unique identifying niuiiln 

* Telephone number (unclassified only) 

* I- mail address (unclassified only) 

* License plate minibn 


OR 

3 (U) Two c* more of the following 

* Country of cihzenshrp if diffeiml from place of birth 

* Place of birth (my or country) if different fiom country of citizenship 

* Ctica or partial date of twill (partiaJ [e g I960] or range [e p . I960 1965]) 

* Full name of an immediate family rurmbei {e g _ parent spouse sibling of child) 

* Occupation or current employe* 

* Specific degrees received 

* School* attended 

■ Physical identifiers such as race, height or weight 

* Unique physical tdenhfiriv such as scars, marks or tattoos 

* Street address or oilier sufficiently specific location information 

(L FOl G1 The u atdbJisl request and or acconpauving EC must contain all the known 
identifying information on the individual. even if it exceeds the nuonmim specified above This 
mas also include photographs fingerprints or other biometric data Furthermore, all available 
ideuiitjei s must lie subiiiined to the T5DB either on die initial request or on a subsequent 


92 

SEC RET NOFORN 


Si t Vt |yr OMiF 

{U)( * HfftfrriRy '# i >«n IMm if f 


rfjiffli fi* alum fr#|jer*U In ItmtlH ate *#iir \stt* e ■. -aMated } j> 7 P f / 4 *. '-rvfr vfcul nwy ^ 
itm-iimalcd Ui Air I SUB wrlh rmly par* id jdrTitiltnt *' 

(IJMPOLJO) Print Id any nutial nutmtiMirm mnfhiv jbt#i m removal the *frm and 
»upriviptm w*»t review and afWrr : i tfv Mlowinf taxor* 


* (Uf/KOUO) The iflrftwfon v nr ary and r ranpieP-r** ■.*, d ^ a rbir l 

* (U//FOUO) Hr appr opt i jtwu of tbr dr tvj&M ten di w ■*> 

■ f U//HJUC Jj Hr mduattw of li i Ibi Ibr vdbpcf » ' Aamul and DaagenMf" 

has 'Violent Teadcnan," w appMprtH* 

* (U//I OUO) The iucIlmeiovi of any artrvr federJ »ratff v ihr &r tf » &r 

agmt/sijpttvifor must ensure fbai tfie en*y n^uni » i H»flr /V *r*r n. 
provide dir warrant nnmbrj 

* (U//FOUO) Tbr lurhawo of a (fiat all aw. r*«r ybmi < 

conditions have been requested identified as appropfiafc* 

* (U//FOUO) The accuracy of Ibr inv<^bjpli\ r fik punbn 

* (U//FOUO) If the subn&ssHHi nrqfurils an rxrhj^ioa b-tn a part ■ • . -rf 
exclusion must include statements m dir wMcfrlisl requrw and t -jtr rsp oflAftg EC 
justifying the exclusion 

* (U//FOUO) Tbr submission of photographs for each subject 
a JPEG format and provided to TREX 

11 . 8 . (U) Expedited No Enina lions 

(U/TOUO) Expedited oommatioas arc available if 
TSDR In die event a subject s watcMistmg requires expedmog • r g. 
the nonunation must be submitted to TREX cdbnor buutam 
Operations Center Waicb (outside normal btnanevi hours 
coordination with die NCTC and or within TSC Expedited 
criteria for entry m the TSE© The TSC will make a final 
for the TSDB. including die T$A No Fly Ion ex Sdrcte* Law In 
subject's record will be rxperted to all apptcspnaJr stfjporwd viteeang r.'^. 

(U TOUO) All expedited nominations must hr sitotfted ■» acowbaa wA ^ of 

this PG and be processed immediately by TREX whh rjbiequeaa vuberstiot i Sr TSC Aa> 
supporting docunKittatjon necessarvto meet the normal srarhitmg ^ arcsras 
pio\rded m the original expedited request rmex be ptcnrided lc TREX on fl 
The TSC must remove the expedited record from r J>e TSDB a ad ill supported >v=3< 



f (L r TOUO » An uMbibr, Id wiidwe a wmrnaasm fct a Hr T33© aer 

uiforsuacei wiifa NCTC fb* potalWr urhiKwi wi&u m TEX. iittw r TIDE li;ie 
put»l or Enemeclirv ml^rmsDOD. 
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hi»ui \ unless thr runiuiuliur nfIVut siiflh mil dnnjratory mhttnuliini Ihmugh I Ik* 

routinr prot'rsx 

ll.V (|| Aiml \V]in uuf Intel ] hiI Noilies Ini Wnt< Misled Indiviitnnlv 

(tl/fOU)) If an active ledrutl anrxi waiiant exists in live NC 'll Wanted ftrtcms J ilr fof 4 
tmonsni lulled, tin? rasr agent must submit a wall hlisi request Un uornmatitm to 1 Jandluip 
Cixlr 1 TV tiottmmstmp EC and request must ukJimTc dir NCR wanant tnunh i (Wauled 
Prisons File irrotd nturihn ) In dir uivestijutum of a ruimitl v waft 1 'Misled individual liiiN 
ilocim miiatiim must mchidr all drscn|rtivr biopiapluc al m raiiiumaiy mioniuimii aliout dir 
subject d tat has not all rad v l^ni rnternd in d w 1 SDR TREX will review dir submitted 
information and forward u to th r NCTC fin rnby into TIDE ot dmrrtlv to dir 7Xt as 
appivipnair 

(1 TOIJO) IF subsequent to entiv as a Handling Code I tlir federal anest wan ant erases to he 
active in die NCR Wanted Persons File Ir g tlir anrst warrant hat been tn vrd or recalled liy 
the court) the FO must submit a notification EC and watch list modification irqurst within flirrr 
business dav^ to change the sub|rct to Handling Code T TREX must sufimr tlir modi lk at ion to 
NCTC foi entry into TIDE ot directly to thr T3C. as appropriate 

(1; TOUO) In late circumstance's. such as a sealed, fnietal indictment wlieir a subject may not 
have a Wanted FVitsoii File rerot d number ui NCIC. it may be necessary to keep information 
concerning a pending federal west warrant out of die TSDB In such cure uni stances thr 
notification EC coQcmung dir warrant must pi ovule a icasouabte and detailed justification for 
dir exclusion (refit to sufeso etipn 1 1 1 4 of this PG) If encountered by law enforcement and in 
order to ensure that the subject is detained long enough to allow the indictment to be unsealed 
and an arrest warrant issued and served such subjects need to be walchhsted as a Handling 
Code 2 (refit to sub section 114 11 of tins PG) 

(U//FOUO) If an active federal arrest w arrant exists for the subject absent sens itive 
circumstances the case agent may apply for an Interpol Red Notice Interpol publishes these 
notices to member states so dial if tlir subject is found, the subject can be attested and extradited 
to the country ho l dine the warrant 

(U TOUO) If an Interpol Red Notice is filed, a watchfist modi.fi cat mu request must be submitted 
to TREX with the Red Notice number 

11.10. til Subjects Al levied or f. oniicted of Tnrorism Related Offenses 

(V TOUO) AU blown terrorists must remain watchhsted (refer to Appendix A of this PG for a 
definition of blown terrorist"). If an TO doses an uiv estigauon of a known terrorist (eg after 
the cmunal. investigation has concluded) a modification mutt be submitted via die TR EX 
113-9*0 Databas e and die dosing EC. with thejiitti fit alion drtads attached TREX must then 
submit a request to modify the TSDB record ui accordance with v ii i .h JJ ! LJL of dns PG 

(U TOUO) If an individual is acquitted or charges are dismissed for a tnnie i elate d to terrorism 
the snbjecl must be remov ed from die wufchlisl unless the subject continues To meet the 
watchhsnng standard (jefcr to sub section I) 3 ) . Tertonvm subjects convicted of jjantenronsrn 
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hm «i immtw* 

flfyf '«ii4erirFiofi«r* PHk / 


urii-nm must br inwivrdi horn tbf utile m tfte w& hltKtztr? \\ *r AjtA * r*+t?.- r 

uirl 


Ji ll (I/) rNcm^ulijMl 
(1 P//FOI JO) l ypn aII y lV FBI only rrarntuiet subp* K A j ped* JtrA i 


for 


UmUf 


wall hlislinp Fjpwrvft c rrtajn c rrnamlaip e* rruy arpr »n wtnrh rbe I HI Artn'imm * pmr*i 
who t\ jm>! llw iub)n f of a predicated invest ijj^Binn wtefterfi i 
wav hVlmg '.tkiifLyd (trirt Ui Jiy' Ijotj ] | 5 of thfi PGj Tim may mriudr m t 
{ in lumlaiK <■% thr subject pf a flowed FBI invesbflat»oni 

flWOUO) Hus proces* Ui wan him ari mdiMduai may nut hr ntoii;ud hared 
suppositions IV nfirritnaiuutf official nutf provide parbruiafized dnof^ktry 
< out n nmp, the dural po**rd Ijy oomubferl* who nrrt thr watehft sting standard Ib £ 
tV KHI may only nominate m individual if both of thr followne ntetu haw V*i» 

1 (U//FOUO) TV individual in nut residing or pmnnriifJ y torflwd m 

7 (U//FOUO) TV individual lias been junked to thr rubjed of 

investigation or thr HlJ other wjsr pnwv&n siiflirsnri deregtoory 
the sLmdard foe watchiistmp 

(U//FOUO) FBI personnel deployed with DoD rnrmrs may not i 

operations conducted under DoD authority These mcbvidu*h mr nnmuutcd to the TMJB t-v 
DoD 

1 1. 1 1. 1 . (Xj \onsubjecf NommaliOD Proems 

(U//FOUO) Any FO or la-pat with information regarding a tMMsribftxi t 
(e g former subjects who have V ft dir ccutiry or suspected tetrorafe identified by feveifpr 
povemmerils ] mmf submit irrforniation to TREX for w Aciiiistmr m ar-oe dance with flat 
following procedmes 

(U /FOUO) The FO or Lrgat must submit all watddist requests to TREX m She T R£X FP-930 
D.u.itw A watdihst request must V accompanied by a supportmp EC w eh m approp nm 
action lead for TREX to assume r espoosi Wnv for dw wasrhltst record Ip ehe evfsm of m 
incomplete request TREX must notify the FO or htgM to roubmrt die Eimsmf ekxrjrrx > li dte 
individual is already waicliliVTed by another agency TREX qbbj viihctrt » 

FD-930 to NCTC indicating FBI interest 

(!_' TOlJO l Submissions to TREX must be made m accordance with die tnorbaes rsia* ii:iird to 
subsectio g 11 6 TREX will not nominate or take over waacbfra respoorAilirf if Ehr FO piwvin 
insuffinent uiformatioQ regarding the subject TREX mB ootiT* tbr FO if oxraB CE^umaances 
preseut watddistuie 

11.11.2, Review of Nonsubj^ct Rertirds 

IU TOUO) Nonsufojects uommated to the TSDB are tracked by TSC nsanf the FD-9KI 
pAulyse TSC ts respousiblf for ^eiifvym and -.abdacmg the wanriiltst slatus aft SlOl 
nonsubjects annual h to ensure rhat ibe uiftmuDoo is accurw aod mat itoillijwir n^ertmg 
cont murs to suggest the USPER poses a national tectrarv mk related to teoomra that rmm 
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watt Jihstinp If TBC drlemunes a nomnfarvl on Imipn Hint s llir wati Misting ilambid, TS( 
must innnf thr norasiibini fiuni Lhr watrMisf and notify tlir FO in I eg at office (!ul originally 
TiortniLitt-d llir iwhv tdual 

(l ! TOUO) If 4 witchtorted oannifayect is rncoimrnni the TSOU will follow nomiaJ 
two hi anon procedures Ou catnplrtiafi of thr mrowitn a ropy of llir 1S0U lop must 1 m- r 
mailed to TREX foe addition*! follow irpji ding thr nomufarci v wan Mist status TREX 
must imm il*e mcountn details to rosin liw individual mrrts llir watrlih$1infi; standbf d jik! 
must modify thr rrcofd with any new identifiers developed [f a nonsubjecl is nKrtninleird 
during navel within tlw United Statrs TREX will sel a Guardian lead lo thr appropriate fO foi 
appsofnair local response If upon ckmur of thr Gtiaidian lead thr FO determines their is no 
nexus to terrorism. TREX will submit an 1 D 910 to remove die subject from the waichhst 

111 L3. ft") Ntmsubj « t Nomination from DOJ C ontponrnls 

(1 ¥OUD) On October ), ?00S DOJ dnapatfd thr FBI as thr i nitial watch list nominator for 
all JXll components Inhumation irgarding known oi suspected ten ousts developed through 
othei investigative arum of the DOJ (e g (lie ATF, llir Drue Enforcement Adtnuiustiatioii 
fDEA] oi thr United States Marshals Set vice |USMS]) is passed ai the FO level through 
established lelanonships with thr FBI JTTT Thr NJTTF or thr CTD program management unit 
is lhr recipient of tent* ism ut format ion whm provided at (hr headquarters level If the FBI does 
not open an investigation but thr inch vidi laity) mrrts the iionsubject nomination ctiirm listed in 
subs ection till the FBI recipient of this information must provide details lo TREK as 
desorbed in subsr c ttrai 11 II 1 TREX must ensure die individually) is properly wait Misled in 
accordance with subsection 1 1 7 

(U HHJO) If die United States National Central Bureau (USNCB) obtains ttCTOCt sm related 
intelligence it nil! provide the intelligence to CTD. which will review thr tenonsin intelligence 
and will generate Guardian assessment Leads for inv estigation as appropriate If a terrorism 
investigation is generated as a result of the Guardian lead, the subject will be submitted for 
watchlistme in accordance with subsection 1 1 5 of this FG 

1L12- (V) Foreign Gtfvemant Information iFGl) 

(U TOLD) Foreign governments occasionally provide information regarding non-USPER 
individuals who »e under investigation in thru countries for crimes related to terrorism or 
individuals who are reasonably suspected of engaging in terrorism or terrorist activity Time 
receiving such specific derogatory information of only non-US PER individuals may submit these 
individuals far watchhstrag The receiving office must also seek and collect available identifiers 
avid biometrics te g . photographs and fingerptints ), as appropriate If such FG1 is provided 
through an established Of formal sharing relationship between the United Slates and the foreign 
gjOT c ramia then reasonable suspicion is presumed The reasonable suspicion standard 
however must be met when information is not received under an established, formal or HSPD-6 
sharing process 

(U TODD i When FGI is provided bv a foreign agency with a terrorism screening information 
sharing or HSPD-ti attaugrmenr with the TSC Legal offices must determine if the FGI was 
provided by the parfnn agency pursuant lo the arrangement Each arrangement defines a unique 
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W4b hliHiirif tuttfLtfd tlut rubfccta sublimed by ti*e p*mrr agjmnr ***** oM tod dae partotr 
APfut y mid designate dir infnrrnMion m bong submitted pwr v*to< u> tr mmppmer* m Ihn h 
thf if mdi< abort l)kj( ij*r iriffif uutiofi held « dir lonl^ the tfandard a* dined « dir 

atanftnwnl 

It .12.1. (U) \1 ale lilivlmg of * nmuiJil Joslir# t*itn m*tu*m Smirnii CJttj Dfritfd 

Information 


(U//FOUOJ FGI provided to GfIS through a mnnorandiAD of 'ooprrabao or tends 
memorialized agirerriern establishing a foirrui m/of mafy« shtoiif trUtMwi' tup ««di a 
panuet may be provided without paiUridj?i/rd dfcjogatar y mfoonMioii (hrerdy to MCTC CJIS 
ptm ides ihr prj sonal idmhfier * and biometrics of (hew mdb vidua!* to thr USIC ac> part etf ri* 
HSPI) 6 mfantiaiion shaimp resportsibihiy This u not d FBI rwnnnttjfin FGI don oat cojmh 
an mnuaJ review. is GJLS requests updated inform* »oo on a rrpiilar bast . CfB nsr.t trwad 
anv updated ulmLi hers it obtains to NCTC so thr TIDE reread raay be updaAed and NCTC a» 
detrrmuie whether rontuiued watthll&nig of die individual ts accessary 


(U//FOUO) IF a foreign government provides records thai mcludr a mdtfure of toTorsno 
c riminal of ollirt mfbrrmboa CJLS must ailrmpf to identify and separate records fritted to 
tenomni ?lv only frnof ism records are included m TIDE and thr TSDB If CJIS naiw( 
dtMminush between thr ciurtiiu] tertEman. and other rjirgum of recorck n may net cubes* 
die entire bitch of records In addition mfc* maiiori provided informal] v or cm as ad bee bans 
must not be f'ui wudrd to NCTC Such records and anv biometrics will remain a part of the Lar err 
CJ1S biometnc holding and wiJ] inimn available in the future to connect individuals to 
terrorism 


111 2,2, (T) atrhlisting of Legal Derived Infot mitkui 

(UtfFOUO) All Legal offices that have obtained FGI terionst m£orm*ioti must subra* wttchlt* 
request* to TREX via the TREX FD-930 Database imJess provided pur stunt to to FBPD-d 
sharing arrangement with the TSC A watchlisi request must be accompanied by a supportm* 

EC. with an appropriate action lead to TREX to assume respooabihfv for the watchhsi record fa 
the event of an mcotnplete request TREX must notify the Legal to resubmit thr unsung 
elemeuti s) Upon receipt of the FGI fiom a Legal TREX must review the information and 
submit a watchlist request to NCTC if the FGI meets the w aichkstia? standad If an FGJhien'.ed 
subject is enc omtiered die nortnai TSC encounter process must be followed Any new 
identifying mformatiou must be provided to TREX which will modtfv thr vnbyect s fac f r ap h ai al 
uiformatioti TREX must sel an mibnoauon lead to the Lega fegardmf die new Lniormaunn 

(U TOUO) FGI proMded to Legal offices pursuant to tenor ism screening mforrufioo Jurmg or 
HSPD-6 arrangements with die TSC should be sent via EC to the designated POC withn the 
TSC Infem anonal Inionuati cti S hartm? Program (ILSP) The partner s original submtssaui m 
Excel Wofd or other format as submitted by the partner should be attached or forwarded bv 
expedited mail tar gat offices will be contacted pmodbcalH K ESP to assist m yotxtnt the 
partner for updates to the uifonnaSiaii 
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fm KM Will IIHIN 
(If) I mnuntrmmisiii Micy Guidr 


tl IU (l>l 1 4 Sut»nii^nm Review IhiKni 

(V TOt H » \ inunist sbio^jfjhu ttibnuUm ml (iltMolp^ili (ilnmlKil nlwvr m di«ituw 
H 1 ? ? ol dm PG) ihat air puwulnl fry a fntrijm gini-iimrnl mml hr sen* In THIvX and 
^«iKrsvr%| m\ Till lit! X will p uvn lg (Jii% innmst inhHiiution h» Nt “IT ilimp with jn Ml! JP.I.U,. 
*f ltmfc'd m iif tin In ruin the indnutiiaJ into 111)! and dir I SIB 1 KI.X will not imunii 
lAlvivmil ovnsiphl m irvirw nf iIm-w Kil in ends links* ariililitnuJ mfo< matron is pmvidfd by 

tbr linn pi i government m an CfkCOUDta Deri™ If a I cpat obtain aikiitimual tdenlifiris 
ilnnn.ilniV Hifumatmn or reason* in intmr ! ( il frixn I’TDl die new uitrlEignifir nm^t be wnl 
in TUI X winch mil fmwaid this mtiwnulitn) in NCTt- Thr miptrul recipient of K il femmun 
tufmnmiim mutit alwpintdr finperpnnts and binp aplm mfniiiuhim ki CJE, if avarUhlr 

11 1 1 |I ) Unit hln (itie id llwr*««l Imlii iiln.il 

(U'-T’Ol JO) Thr TSDB may nth include identity infoimatvoii of known oi nixprc tnl terrorists 
who are c<*iftnried dead unless 

* (0 l OMOT There is tutor mall on to suppoii a mooiuble smpituni licit ai\ existing known 
o< suspected tnronvt is using liut i den mv information 

* {U TOU01 A leropuzrd ininnst rngaru/Jlum collects known or suspected Imonsl 
identify m formal ton fen vise by its nicmhns in preparing foi m committing tenons t acts 
a »d the travel documents lehled to tlir deceased known or suspected trrtonst have not 
been rrcovnrd 

(U TOUO) Note: A classified list of recognized trrronst organizations that are known to 
reuse trrusist identity infos maiion is maintained on the NCTC Current site available on 
die Sensitive t ompartnirntrd tnfomution Opeia&oiul Network (SCION) 

11.14 (l ! Liflusion fi on* a Suppoi ted System 

(V TOl. r O) In rase circumstances the subjrci of an investigation may be excluded from a 
particular wafdihsnng supported system if a reasonable and detailed epe-t afioiial justification is 
provided An FO that wishes to exclude a subject horn a supported system must ajtrrulate the 
justification as part of the watchbst request and or supporting EC 

(U TOCO) Noie: 7 he existence of local or state public disclosure laws are not sufficient 
justification for exclusion 

(V FOUQ) Subject matin experts m THEX mil review justifications for exclusion from 
supported wxtems and determine whether die exclusion is warranted TKEX must notify the 
subuuttuig FO if an exclusion is rut warranted 

II. 15. d') Redr ess 

(V FOI O * Itidrv i duals may seek redress for travel delays and other rnconv rniences thev 
experience due to screening and or waichfrst issues teal or perceived An interagency 
A/.vt 7-. h;»; on ler+wiiT fflifL hiuTpif; Rwrttts Pf tx *Jur es between the TSC 

rlir FBI and other relevant agencies is m place to address how each agency w dl respond to such 
requests for redress As nidi, the TSC may request additional tnfonnalton directly born an FBI 
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fU) f *rf»i«ninifji*vfn f **A» / f j >»cHr 


I U tn 1 f jrp 4 i to IP-WJK uni |fj J Irtffir^ frif A» Hi 'J* 4 r * +& tiri# pt'r&tf A* tt£fjmmS*’r 

irrpjrvtrd by f SC within Hi far frf llir fr, njA of if « ir^ir ? Aftri r far jp^wfaMr 

mfomiMioti IV friakn tlir fnuJ fain ttmutuir i m l#» whrffin ir unfa Uwt (rrfiH ml; frrruim hti 
Air I Sl>l! brnwidfhrd at \w mnrivnf 

MIA fl ) JnJjonwLt hitlwimd f mm-HI «f W air Juft- 1*4 P*m 

(U//HJUO) Jfthr J HI want* a wathliawi vjliym to fciv- rurnpnM vimw* 

4^rtK m at far U S Undrr advanrr c txnfaiMv** I***™ Air H> far CTO papas 



povnnfTimt aprfti inv r}ut rnAupr audio f u»r far trnotKm w^rMt*! arid is -fair to hnk*M* 
i rcjimf t to avoid iffiim rvs* y drlay ¥id'« addttwnal tcti»¥ of wfajttA fw far M 
dniin to aJbiu ituiftqjrdrd travd fr £ ufjiiftcjtf pifatif bmHrT pdm) HU irqiWf 
mbjrrt Ui dir nunuinirr of far * imunf asrory **d may urt afnyt br hcMaurd 

(UWOUO) TSC may aiwi audton/r a onr tmr warvei to allow indmduab rm (far 1fa» ffv Ufa to 
fly into m out of d* l mitrd Stain Thr FO t *fgm mtdim CH} pt off an ffamiFriarni rot nwfa 
COOT diiLitr such requests with TV is Operation's ( rmn Mo to tbr J V#*.. intrjrr-: -v 
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12. (l > Mi CIhmK 

(U H M IQ) Hus section \\ mu iriintrlrd to be an rctltuislive <li x nssum of .ill jvaihlijr 
invrifljtitivr titrthitds but i jjIki of tUw- unique to t unnlritniofisTii tnwnittgplliMai I 01 4 nwwr 
tfhnoit^h d]\nt<iViiHi of all available nivrvligatiST utrllukk n'(ri In (hr |)I(K ■ 

II I. (l )Nimf lr«« 

(IT T’Ol JO) A n .in it trace is a (omul trip test tn anollin ^rnmimmt .ijmim y In t inulih 1 a irairh 
Ol rXistulp ft* ulunnatuxi irjutdinp A Mbfed of mtni'sl Rrqursls leu luiti r bates air 

aJh handled by (hr CTD piogjam ntaiugcmnit imii FOs wislnxip to 11 m a name tiacr may 
send an H with a lead 10 the pi oprvu management null itki luihnp 1 thr tubjetl s pirihe alioti and 
all a\ aita Mr identifins 

IM I |1 ) Vuthm imi ImrvtigaHi r At (mil 

(U r TOUO)Natnr tracts air auihnn/ed in both die IT and Dl Prop Aim at all lewis of 

mvestiganve activity 

121.2- (1 IOI O) l IA Naim I races 

(V EDl T Q) Request^ to the CIA for gaveijd information are submitted ikdiuMCally via tlir CIA 
E&tenul Naur Trace System (CENTN) CENTS requests ar handled bv CIA % External 

an hr accrued via thr SC ION system .11 the following 

H I 

of uiVTOlvSiiBniffixiSSSnuniSr IS no kmnm raonp or nrhvoik wiih which tlir subject is 

iffilylrd 

(IT TOCO) Ff thrrr is a known group affiliation rathci than using die CENTS system C TD 
ptngtwr] will subcult a tsace icqucst cable (irfei to tlir CTD Temp lates Pape ) to die appropriate 
element dut handles that uioup witluu t 1A A Countertrnwvsm Center (CTC) CTC lias a cress to 
some data dial » not available to thr EIB which may piovide a fuller trace response than wlm is 
as adable through CENTS CTC Wilt onlv conduct a tiare of a subject who has a known pinup 
affiliation 

12.1 V a FOIO) NS A Name Trim 

(T : TOtO) Name trace request* to the NSA are also sometimes called irqursts fm rufoimatiou 
(RFI) Legal constraint* forbid NS A from conducting trace requests regarding USPERs NS A 
also has special requirements regarding a citizen of a Five Eve s l EVEY} meittbei country Hills 
it is important to know- thr nationality of thr nace target and include it whenever possible An 
NS A request can be made by one of two methods (1 ) electronically using NSA s Custamta 
Gateway system 01 ( 2 ) via an EC 

I 1.1 1 ..liewav method iateway 



system umjip the SCION system ai 


2 (U TOt ;0) t C method An EC may also be used to subnet the necessary information to 
the NSA s senior representative to die FBI who will tbm forward thr information to the 
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miIiIii**, within NSA Am r*^upir of \ f * m be 1 to*®d o*> ■'. kfr *** 

I4k 

III, (1) Inin t lent 

(U//FOIJOJ An min view n thr quertiotfiiiFf of «« itiAviAhJ lurfmr a i ‘frrr'1? » i rHWBn 
rlm^if d to gailirt inhumation that is m* m ate prftumrt In aid wrftoifi tor of m 

authon/rd zuwtnn* m predn ated ifivroi^aliein See QK£ 1 1 

(U//FOUO) Fof ruk* art! vLmrfciiil& on tiir umlrici of tfDrfview* frier to J-'X Vr1»* If 
1 II. I. (l 1 ) Aalbori/rd ArtmMv 

(U//FOUCJ) Interview* are author t/rd m both the fl and IJT Propprai it afl V-^h of 
iriwvtigaliVT activity 

12.1.2. (U) !>« oriflu tmu 

(U//FOUOJ( An FO must unpirrmn Aunt? drr ofifWtion mnajrr* pf lor U> Bter' i^-ww tor 
Mibjrel of a predicated invrihgatwn to mute thr uatervirw will nofl romprocnw p>'fitifiiw 
in olhn J-Gs or aim the subjrrt v associates Such drr nfjjQjctaoffi emte be {tonjottafted no thr 
mvtstigabw filr in advance of thr mtervirw A copy must aJ*o hr prcAidcd to thr tiupnfH 
maiLapniiml mil The drrunflirtion doruiiMTittiion nw> adtons thr followm? amn 

* (U//FOUO) Thr namrK ] and imevtigaii v r filr mudbafa; of mtf FBI rtyadf *r bow id 
hr ill contact (e g personal trkphomr or r mail j wtlh thr sirtye rt of tor Kflervtew 

* (LVTOUO) TV namd>) of any mdrvidtixKs) of Mgmfratv ootn it g a knows m 
suspected tenons* abtoad who is not thr subvert of an FBI nr» rsfagataac j Ie&owd to hr m 
contact with thr subject of thr interview 

* (LV/FOUO) Thr freqvieDcv of cootan and thr date of thr last com* tor each arimtod 
m our of thr above groups known Uibern contact wtA tor subject of tor temifi 

* (U TOUO) Thr steps lakes to coordinate with otoer f Os Lrgars and or L'SSC federal 
sta.tr local Of forngo partners whose tnvrstigamT equities usry br impacted by a 
planned inteivjew 

» a TOI "O j An anal vms of thr potential for an mtovaJuaJ m cootacr onto tor wfayd of 
thr interview to br aimed to possible FBI mvrsngative mterm 

* fU TOUO) A svoopsis of tor general uxtrrvarw approach vPatrrv r r a to torypte i 
secondary scnreuKjg by CBP or a possiblr offer to breonar a CHS j and *iv Mst purpose 
or noifcdiscloMter of FBI aflUiafioo that is pLacued 

* fT' TOt O) Wltat if anv information from icsnitjvr source- c ^ FTSA a j se^fulax 
CHS) has been used to formulate thr interview quribacB and nha are tarsnf nrires 
lo protect the smsitiv r sourer 
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12-3. P. fl 1 ScD^liir PtiMiKi.il 1 1 ares 

(S NF1 Sensitive C LA fm-iii i j] traces axe available as a resource For all levels of terrorism 
«t*s itafntivr activity These requests are made to the CIA National Chmdestioc Service (NCS) 
which mamruns classified foreign brumal Uanvu tion data Sensitive fmaociaj traces differ 
from normal C LA names traces Obtaining access to the data available from a sensitive finan rial 

trace requites a separate request 

($ *NF) Requests for sensitive frnaoci.il traces must be made via EC to the jpps ops Lite TFOS 
amt and CTD program management umi under die TERRFIN subfile of die respective 
«avw&|fioft Upon receipt of the EC crquesttup a sensitive financial trace TFOS will renew the 

request aid draft the appropriate cable for NC S 
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(1 0 Outrun in nn lOT i Policy i Jwde 


17. (I FOl O) Nd lulitn Niilioihi! Itiiliitlh v 

( V RM TO USA KVETY) Trrtoiub tut of iltr tnlnwt lus pinnited dir FBI (heUSJC law 
cnftrrrmrai aihS l S allies witli a senom dulletii’r I tic bill I ml ts a ptinc i|k«I iuol fn imnri'il 
OMMni .’atnins m countmag the physic il disjtn vd and dn mbah/atinti Imiupjit on by ihr 
American and allird response to tlir Sc|Mcttslwi 1 1 2001 .ill a* 11 k* pen rived vKifjvniity 
security air! efficiency of online coflumuiurationi have attracted itu* attention of tmonsts. then 
fjrihtaloi s and their sympathisers Ike it-sult has been an explosive prnwth of Imfltwls using 
0i c Intel lie I fen i oiiiniiinii -atioi^ jnop.ig.unia disserimulmn hmdiaisirtg rmuilmenl operational 
pUivmnr trim u if and radirali/aUou Efforts by iltr Flil and its partners to investigate, exploit 
and diMiifii terrorist networks wr hemp cklleagcd by dir rapid giowth of ten crisis use of dir 
Inin nd tn May 2008 the NTN1 was appmed by CTD 11 ic NTN1 is constructed to 
strategic ally foci» operations taigetmg tenants use of Uir tnteinrt tluough OCEs, UCEs and 
CHSs 

Vyle: (U//FOUO) No* all Group I UCOs will lie mcorporatrd into die NTNI Each 
operation wilt be evaluated on an investigation by investigation basis and a 
dctennwatinu made based upon several entmt iik eluding scope, goals and objectives 

I <1 KOI Of Net I al*n Gods 

(S REL TO USA FVEY) Tlie goals of die NTN1 aie 

* (S REL TO USA FVEY) To detecl penebate disrupt and dismantle uiilme terrorist 
networks 

* (S RH TO USA, FVEY) To know n inns tor. and target ail adversary s online domain 

* (S' REL TO USA, FVEY) To identify direct and recnul die most appropriate FBI online 
resources to target U $ adversaries and their online domains 

* (S REL TO USA, FVEY) To develop and manage online resouices to maximize 
HUMINT pmeoaiioii into online tenon si tietworks 

* (S REL TO USA. FVEY) To esiabhsh and support standard operating procedures for 
Group 1 UCOs targetuic terrorists use of the Internet 

* (S REL TO LtSA FVEY) To establish standardized trauuug fot appropr (ate NTNI 
personnel 

17,2, (l i ni O) NpI l altui Ohiectivfs 

PM <11 Effective Tasking oflndercnvei Peis cm ml 

i S REL TO USA FVEY) The establishment of the NTNI allows visibility into die online 
act) vines of all OCEs UCEs and CHSs targeting IT subjects and provides a program to ensure 
thrv are tasked according to thru skill sets and workloads ITie use of OCEs. UCEs. and CHSs is 
warranted when rl is pmdnit and necessary to provide support and or assistance to ongoing 

m\ estimations 
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17 2 2 (!) (rnlr alt/rd Ita fiRiflklfou 

(SZ/RiXTO USA FVEY) rv N’rw rstJilrshn Ar -ftrtHltffd mrtlwfc rh* will U irted to 
drr cnilhci L ayei* OCE*. IJCK* and CIlSs within the FBI the USK md ri*nn*x*di par /art- 
l ot irwjff infmiiulMTifj idrj in ihv Tn<ri J / of thin Ki ir^firnp ibf Nrl TaJoft 

1 7.2.1 (V''M j I I * jijttB*, wrllt I Sff and ftfnutiofiii Partners 

(&//NI-) To neef die FBI s ndiuori of ifiielhpejw t rottertion -tod to respond to rtjvettjgoto ..r 
(m>f 0 ^rn fHiontlri ii mliiRul and/or inter rut ioriai level* U is nrrraa rv faf (hr FBI lf> r/jnAjrf 
joint oprt Aljtjjjs with thr USIf arid imematiortaJ pMinrtv The NTWI will support these jomr 
operations And has the capability lo ittjfl/r j?J the fevjitfrrs Mid tools available to the FBI I SIC 
jjuJ iiiirrnahofial Li iri *■ 

17 2 4 (V) 1 «uwd Mialpgn and Jaifn al VflaKtm *1 f apaMb^ 

{S//REL TO USA FVEY) A significant r ornponmt in jrx\y rmy IT or. nt^aHnon h x.<fjsra4 
enough ajTjJyin aI resource* to jjuJ v/c and disvn innate the m far mu on rofledtdi Is the pad 
these ifKimrfi weir limited to the amount of per vjrmrJ m a particular FO and tbm rrW** %kiil 
sets Hie NTNI creatr'i single points of contact withal thr FBI that are center* of rxpertMr far 
a particular target wt oj rooimurtirairon platfainj 

(S//RFX TO USA. FVEY) These renters of expertise help to produce analytic product* lo 
enhance die knowledge of terrorists use of dir hit non develop tools for idcniifvr^ and 
dismantling onkne lenor isl networks and share trends in irnomtt uv of the hsemrl It m 
irndn stood tliat targets may cross cartels of expertise As such C1TU m responsible far both 
emiifing decoofUctian between the rollers of expertise and for roordmatioei of effort 

{StfREL TO USA. FVE Y) The centers of expertise provide the FBI l' SIC and irvtrmwiraal 
partners the ability lo draw upon the knowledge and resources of the centers cn tbm 
investigations NTNI analytic products and reporting are dissemm tied to the FBI U 5K and 
gii eiTui i ou4j pa/tnm as appropriate 

P*2*5. (V) Idenlif' and Address [rirtLli£MJ.f 

(S 'REL TO USA. FVEY) The NTNI addresses known infrUtEence gaps and rdmtihrs online 
terrorist networks m a centralized manner consistent with the AGG Do m and DIOG The 
initiative s roliesn e anahlic c-rpafnltties allow for su^ghtforward lecognitioD of mteUi^nce 
gaps and comparison of newly established tfaeats Simidtaoeoush a network of associated 
UCOa effectively addresses those intelh pence gaps 

1U.1 (!) EstutilUtiuipn! and Shanug of Br*s( Practices 

(S REE TO USA FVEY) The centralism? natuir of the NTNT lords itself to the jcfrroved 
discov ers and promuJgaticni of best practices In rbe post best jxacners were oien bullied to a 
smgle FO or shared otiJv liuough uifomial discu&stons between FBIHQ FCK a»d the USIC The 
NTNI captures, disseminates and shares die took and methods that have proven effective wad 
useful in investigating lerronsts use of the kiterart These best practices we shared and 
formalized ui b anung guidance and cuntmiiRn: ation dxuarirats 
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(U) Cornim Lmomtii ISilit-y iiitulf 


1 1.17. (V) I rnfi alif rd lutHtt|>»icr 

(S Rtl FO USA FVEY) A fcrv t ofinwnutni urNIIMI ti itv ability to function m a dcafinghousc 
fen alt FBT ioteUtpitt regaidbnp icnrorists use of die lotemrl and die colkctivr response io ihr 
threats posed fttMflbty iqnrimg from individual Operatodiis was soil to numerous units withui 
CTD and CyD The result of that system wu fragmented awnparinicmaltzed intelligence and m 
nubility to see and communicate a eoiqprebmsrve view of teironsts use of the Internet 

{S KEL TO USA, FVEY) Undo NTNI intelligence lepoiung ou llie (cnotuti use of the 
TntrvnH ran be rmtiaJivrd Linda CFTTJ. which will apprapiialely coordinate with oilier units 
w ithin the FBI is well As with USJC and mlniLtlicnuJ partners 

(S/ REL TO USA. FVEY) Whm an FO determines that information from any OCE, UCE. CHS 
and oc Group ] UCO under the NTNI affects investigative matters m another FO, the appropriate 
FBIHQ mul mucl be notified and the udbrniabon forwarded to the odiei FO under that office' s 
uit esUgalii e file All ranmimuranons must be properly uploaded to the FBI's permanent system 
of records, unless ejctraordmaiy cifcuimtances necessitate ati exception to this requirement and 
the exception is approved by the Deputy lYueetor (DO) 

1 " 2 8. (11 1 enh ati7ed Resource I den ti Tic at ion and I racking 

{S REL TO l ISA, FVEY) A recurring benefit of NTNI is centralizing the mariagmicnl of 
information andresouices With the establishment of tins imitative. CITU and CTUC are the 
central authorities over resources available to taiget analyze and exploit potential lenonst 
actintv online Additional! v NTNI has established tools and methods for tracking the allocation 
of such resources 


1 72L9. (U) Standard!/ td UCO Adimnidr ative Tasks 

(S BEL TO USA FVFV) Tlie NTNI standardnies the admmisir alive tasks, as well as policy and 
guidelines of Group I UCOs targeting terrorists use of die Internet Standardized language w ill 
be created and utilized in documentation relative to CT online UCOs 


1" 2.10. (I ) t otisisleut Backstopping 

(S REL TO USA FVEY) Central to all online UCOs is maintaining the security of covert 
opet aliens Protecting the true identity of any OCE. UCE. md/or CHS is always the primary 
concern m any decision related to these operations This principle extends ev en to the decisions 
to disseminate die identities within DGJ and among JTTF partners 11 if NTNI standardizes die 
backstopping process and procedures foi Group 1 UCOs targeting terrorists use of die Internet 
Pom to deputing ciiiute nai«BCtt all NTNI Group i 1 •. 1 ) • »• - 1 ;• ‘ ■ I- " 

■ ■ •: • . • ~ 1 : 1 j " ' ' I 

id duel 



r .2 1 1 - <u TOUO) Net Talon OrgamzatHWiI sn uctui t* 

f S REL TO USA FVEY} The NTNI serves as an ot gamzatianal tool to bring similar CT Group 
I UCOs targeting teironsts use of the Internet under the program management of CITU CITU 
exploits intelligence to track current trends of terrorists use of the Internet, as well as renews 
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sm m fmimmw 

(U) f /furrier irjf or tun Pobry * fwdfc 


reporting to unwm links brtwrwi various tm\n# iXfh f TW rtjnAvl'i vkmtu&txnr 
Uslcinjt’i to ifKhyfc llir It* Imp raUatfton and < fxnpiUUoirj rtf OIA 

(S/MEL TO USA, FVEY) A hmrbiw OfHsmKm (FOP) » 4 Cm 1 UCJO § uc fall’, under the 
NTNi FOP* s*e ttw renter of expertise for thrtr target srt or /onBmiftftr aiaon pUthnn, and 
.ippiove ill** usage of OJA airthoniirs and r/Kjrdinate with fTHJ fen all np^aliimal matins 
SnlwpH ation!. (SO) fall uvftkin tlar m -opr of an existing FOP and report dajwtjy 10 ibe FOP for 
ufieratioml coordination Hie NTNI arpani/aUcnal chat is hslrd below tn Figw* I 



Fifiiff 1. (1V/FOVO) NTNI Oi ".iDizjrional Chart 

I'M, (I TOFO) NX I alon Kol^s and I tint lion al Responsibilities 
PJ.l. ft^) Counterterrorism Internet Targeting Unit 

(S//REL TO USA, FVEY) CTTU is responsible for the overall program management of the 
NTNI and the FQPs under the NTNI CITU must 

* (S KEL TO USA. FVEY) Assign and prioritize mvrstjeanom and fca.lv for FOPs 
including 

o (S//REL TO USA. FVEY) Be die lead for the FBI s efforts withm the FBI the ISIC 
and with international partners lo deconfliet UCOs targeting trerwijjts use of the 
tnTeliK-T 

(5 REL TO USA. FVEY) Deconflici assignment of OCEv UCE* and CHS* arid 
targeting of subjects 
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SI ( HI 1 NOl OK% 

(U) ( muilef leirtinsiii Policy Guide 


t\ Hi ! TO l fSA FVEY) Deploy maiugc and maintain Um~ Nr I Talon Database Few l!ir 
drconflivtioti and program liuiuigctnem of lOOlktcs 

(S KEJ TO USA FVEY) t midiKl louimc aurlitv to ensure all profile and pn wna 
mfornuti m i m tfar Nrl Talon Database is t YUiem and m rm iJr 

(S HEL TO USA FVEY) Rrsiew. assign prioritize and track requests tn target CTD 
mvT-stigatjve subjects with an lntcmei neat us 

(S XEL TO USA. FVEY) Periodically conduct an overall FH1 strategic levirw to 
determine wimi »rw ujvrstigatjim.s r.u farting toil oral* use oi' the Internet need to be 
opened Validation is si ongoing process to intmiun review, assess and evaluate an 
FOP C/llU will utilize reasonable methods to validate (lie purpose and mission of thr 
FOPs and ensure they are pnontized within the goals and objectives of CTD 

(S REL TO USA, FVEY) Receive and review intelligence disseminations for FOPs, 

SOs OCRs, UCEs t .ind CHSs to 

(S RIT TO USA. FVEY} Exploit nitelb^ence to track current trends of ten ousts 
use of the Internet 


(S REL TO USA. FVEY) Revtrw and analyze reporting to uncover links between 
various investigations, and provide this analysis to the appropriate entities 

fU TOCO) Coordinate with L'JlfC to ensure all OCEs and UCEs are properly certified, 
trained and safeguarded pnoi to being operational on any of the NTNI s undercover 
operations t TIL- also emiurs that tramiug 

I I mm I 

urfonrulioii 


(U FOUO ) Assist CTUC in die development of specialized tr aining 

fU FOUO) Review and Apply for OLA authority as necessary' for FOPs Coordinate 
with FOPs to rasurr the language and scope for OIA authorities that benefit the entire 
NTNI are optimized Alt OIA requests must be submitted to NSLB for approval 

(U FOUO) Manage tram and provide oversight of the operational use of OLA 
authorities 

(U TOUOj Collect OLA authooty usage from FOPs and provide die proper reporting to 
NSD s Coiwrierterronsm Section (CTS) regarding die OLA within llie staled tune frame 

(U FOUO) Propose manage and allocate budget binds ui stippoit of the NTNI major 
investigation 

i U TGI O f Assist in die preparation and presentation of UCO initiation and renewal 
paperwork m a- cot dance with NSB under cover policy foi all FOPs that will fall imder 
ib^ ptogiam management responsibility of the NTNI 
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(U) ( (nuilrfirirmivri P«4w yOiidr 


» (U//FOUO) Wot k with f TU£ If# rfrirmnnr wfcrihrr an ousting tX O of propose 

laJk within dir m opr of ihr N'FNI In addition CFTU will hHp drtrttmw rf and * 
SO wilt transition mtf) m FOP 

* CU//POUO) Providr the rt* am and mbastnjciisr b e&nurang f * *»■ # vr* w*^lE i P'-n* " 
f'-oLIrrlioti. e (porting, dissenwialian and drf mActttn 

* (U//FOUO) Recruit develop and tram (X h* 1 f. I ■ and Of Si m < oordnutam *ith 
CTUC, thr FOP and in crrtaiJi tn&ianm CHOU tn (be T jrwxwgr S*rv» n fretacm 'LSSj 

» (UI/FOUO) Coofduulr wttli UGH on all issues tooceriunp (far IJSS m a p p fcrrfdr fct (far 
NTNI 

* (UMB 01 IO) Condtoair conunumr atiom and mirUtRctr e dninnuatHtt Wt w w tJar 
FBI, USIC and international partners foi all FOP» rod et prop am mana^rmraT ?i t fm 

NTNI 

* (U//FOUO) Carry out ELSUR procedures ai determined by thr CHOC (hr Operational 
Technology Division s (OTD) Data Irtucrpt Technology Utf (Dm 7) aud HMD t 
ETSUR Operations Unit 

17.5.2. (T) C ous l«d<m(i» Division lidfnvnr OprrilioB^ t nit 

(U//FOUO) CTUC is responsible for the oversight and management of all UCO* that fall widun 
tlie scope of the NTNI and must specifically 

* (L7/FOUO) Work with CTTTJ to drtrrrrane whether m ctisBng UCO « proposed F O? 
falls within the scope of the NTNI In addition CTUC helps determine if and when m 
SO will transition into .i» FOP 

> (T7 TOUO) Coordinate with OTU and NSLB to vufifrat any proposed FOP fiat Gra^ I 

UCO review by the National Security Undercover Review Coramtiee fUCRO and 
obtain approval by die AD CTD. according to standards established by t)* r 0 > 

rnoirn 

* (U//FOUO) Review all policies and procedures >f (he NTNI and provide piudrar as 
necessary, to conform to CTUC standards 

* (U TOUO) Coordinate with OTU to ensuie OCEs and UCTs are prcperh rmifird 
ti;unrd and safeguarded ptio* to operational activities CTUC works with 07 T *«> euvxe 

implemented as needed See thr 



I ten additional uilaimiliiMi 


• (1 1 m o > Work in coordination with CITU. FOP and in certain mstaeew CHOC' or the 
LSS to recruit. develop and tram OCEs. DCEs and CHS*. 

I7.V1, (V) t rinrbb Operations 

(S REL TO USA FVE Y) An FOP $s a Group [ ICO that ha^ been proved bv tie UC Rt wwii 
ns own operating hided which is managed as part of the NTNI The FOP will br a . enicr oi 
expertise For its taiget sel ot cotminimcation platform and Us i espcmulxtetiev mUikir 
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M i Ml I TNOI HKN 
(I T) 4 iMmifi ti'mimtn Full* y ( iMwl* - 


* 0 If/TOtJUT llavr H least Ofir i ihi1.ii I ^'rnl and iw and/m ( JC1 

.. . (\" TOt t >) No i»iv l iiuv srtvr within, Ihr same It W a % Imth 411 OCT ■ «t A IK I and 

tin* casr apHvt fin thr FOP 

* (tV 1 OV 0 ( ih^ii tin 4lr with < Tl\J on all BMlIipllVF matin i 

* (1 ? ' 1 Ol K 3 ) Cnmduiatr with CITU, til It and nlhn imnsaty nihUrs irf'ardjity? llir 
Uifprtinp Klutrgv to lir in if demented by thr ronliiel agent* OCF-i ( llOil. and C T IS* 
wboni thr POP dnerfly opet airs And nunaprs 

* (UtfFQUO) Ensuir tli #i Ihr piniivjiuni few ill m vest 1 pan vr tutfyecb targeted thnmpE Uir 
POP is tulHartilly articulated in thr apptopnale FOP dmimrnti 

* Cl : (FOUO) Approve dir usage of OTA anthuniirs foi OCE* IfCpJ, and CHSi Hie FOP 
itmaynro thr usage of OlA and report to Uii) as stipulated m ihr operating OlA 

t mthn the FOP is responsible fin msui inp all reporting ntfiuimit nts air uni 

* (U//P 0 UO) Motulof all OCE* UCE* .met CHSs lo ensure they air operating in 
canpluncr with ah applicable legal and policy ictjunenients and Aw eh lion 

* (LP/FOOO) Handle irqursts foi equipment 01 oilier resources horn contact agents. OCRs. 
UCEs and CHSs 


(UVFOUO) Disseminate mtrlii grace from OCE, OtE, and CHS reporting in 
coordination with CXIU 

(U/flFOOO) R rerun develop and train OCEs. UCEs and CHSs. m coordination with 
CTTU 


(VffFOUO) tmiei and update OCE, LICE. and CHS information in (hr Net Taion 
Database fot dcOOttflltncm and pm gram management purposes 

(U FOUO) Conduct routine audits to ensure all profile and persona information 111 the 
Net Talon Database is current and accurate 


(U FOUO) Wsite and submit Group I UCO proposalsrenrwals to CTUC and CTTU 
Draft proposals lenewajs will be submitted to C TUC and CFTU for review prior to 
obtaining local signalmen 


[Y FOUO) Disseminate reporting to OTU and thr appfoptjair FOs In addition !o any 

appropriate investigative files FQPs will ensure all OCE. UCE, and C HS 

cotn mmmeattorn air captioned to ihr assigned subfile under theNTNl investigative file 


(U TOUG) Ensure that requited backstopping is done for all OCEs. UCEs. and CHSs 
involved in an operation 


(LI FOUO > Concerns regarding OCE or UCE personnel must be addressed vvidi CTUC. 
C TTL', and the contact agent 
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si i m ttjw&tmr* 

ft/) I *furnrftru<mHu Y*£v y < 


* fltf/KKXI) i jmMr wi& Ihr * *wnH • *** mtmf §*> m*.r ' Vmr 

Uvp^inl flit 011 jdi IV HIP 

<• fu//l fHXIJ Pnmdr Hamer* who will br ilduod fj * ***** l ti /rd u armm by 

C;ITU and CT1JC. JU requeued 

* (ttf/KKJO) WfiHc ifl r^*dfnan#*i Cm/, «TUf *wf » ' **»-<** ^ f # 

| Jifi lu tetrad develop andkip Of li UT4 adCHSft TV FfJP tfttan r *■***%&* 
rnrtlMXk to validate a CHS i KkrttflY dbmiai iMffMl ®d ar> CMr* a CMS 
]i#s Irm rrcnuled tV FOP is int(tiifod to * omply with 1 V t **gi.4mtr if t**a* Zowf 
May f kitdm (WWj) 00 all ni^lrrv ir^vdmf a CHS 

ft 13A. (U) Siiboper aliw (SO) 

(U//FOLJO) An SO nm *1 fall within thr v^Jpr «f an r*irfmr POP and n 4 rvrk>pH a 
(ourdmaUmi with tV FOP and CTTU wrtii tV *t*mf o( htt.aaaojr a UCVf. appmed f C*> 
wVtt appropriate SO* ate iu* rndepri^ienfl FOPs but rad*y wodk jtjtW !V a jtV*<tte* V 
funding of an t%Wmf FOP Refer In 1 - w *1 I &f PG for tV frw™ utffcatmr a* 
SO TV of w SO at no 

* (WFGUO) Fall widtm the tarprim? k-t of the FOP 

* fU//FOUO) Have at lead one contact and one OCt UCt or €3® 

o (U/TOUO) It is not ircoramefKird that ihr prtmar* ci* a««a V an QCt a a OCT 

of IV SO 

o (U^/FOUOJ Iter must be at least oor mdmduaJ of IV SO vk> ■ not ac Of L ar a 

UCE 


(U//FOUO) Report directly 10 l V FOP for iave 9 Kig«rae t 
assistance as necessary 

(U//FOUO) Coordinate with the FOP 00 tV tar gnua? sratefv to V 
OCEs UCE* and CHS* operating under tV SO 

(U'TQUO) Ensiffr (hal the predication for all Btt*st|£ttve 
SO is sufficiently arhruiatrd in tV appropriate SO documim 

(T TOUO) Rrqurst ebr osagr of OIA autVrflin, for OCE . UCE* md CHSi 1 
FOP The SO ^unmanzes tbr usapr of OIA atabontors aid report w? Ehr FOP m 
stipulated in the operartne OIA authonn 

(U//FOUO) Monitor all OCXs UCEs and CHS* to raur* tfcrv are 
compliance with all applicable legal and pohev re«|oin 3 nM 

(U TOUO) Submit Tecpie^ty receded 6 ocn rooiact 1 
FOP fef equipment cw other resources 

d" TOUO) Qrwni ai uig tntellieence from OCE. IXE zid CHS 
ccwfdiuatioQ with the FOP and CHU Ensure all OCE UCE *sd CHS 


rCTR- 


OCE*. LCEt aid CHS* 5 t i 
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m . ^ it i < mol to ill vr hlrs ,m«1 asmpitr I subfile urn In lilt' NTNI 

investigative tilf 

* (U TOt HI) liutja.tr approfiiiair investigations of taipris of mines! Hut air within dir 
scope of I hr SO 

* (V TOUO) Upon the AiRtm of tlir FOP, CITU and CTUC di aft and obtain local 
approval fin a Group I UCO to become an FOP as pmi of the NIN1 

■ (l ' TOUO) Conduct i online audits to msme ail ptofilc arid persona irifoiTi ration in Hie 
Net Talon Database is cimmt and accurate 

* (U TQUO) W«k ul coordmaiion with CITIJ. CTUC. and in ceitain instances CHOU or 
LSS to recruit develop and tram OCEs UCEs and CHSs Hie SO utilizes reasonable 
method* to validate a CHS s identity information, motivation, and access Once 
recruited the SO is lequurd to comply with the Confidential Human Sour ce Policy 
Gjndf (C M9?PG) on all nutters regarding a CHS 

* (V TOUO) Address concerns regarding OCE or UCE personnel with CTUC. CfFU. the 
FOP and the contact agent 

1 7Jt,5. (V) C onlact Agents 

(V TOUO) 7b* contact agent s primary lesponsibdity is to manage OCEs, UCEs. and CHSs by 
acting as an intermediary for all commumcation from the NTNI and FOs whose investigations 
are being supported bv the NTNI Specifically the contact agent mast 

* (U TOUO) Ensure dial OCEs UCEs. and CHSs have proper backstopping and training 
foe the tasks they are asked to complete 

* (U TOUO) Ensure full compliance with the leqmredl paperwork for the participation of 
OCEs UCEs and CHSs m the NTNI 

* T O! O ) Pi ., i dr guidance to OC l s UCE aiu^^^^oHhynipIciiseiitaticin of die 
information 

* (1 FOL’O) Monitor al) OCEs. UCEs and CHSs to ensure they are operating in 
compliance with all applicable legal and policy requirements and direction 

* (U TOUO) Review OCE. UCE and CHS reporting documents for dissemination through 
the NTNI FO reporting chain Ensure that threat information is immediately disseminated 
in the appropriate form to the proper parties 

* (U TOUO 1 Address concerns legarding OCE or UCE personnel with CTUC. CITU. and 

the case agent 

* (U TOUO) Ensure FOP coordination wadi the case agent concerning the subject being 
targeted by the OCE. UC E and or CHS 
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■ (U//FQUO) Sulmut frtprvU for rm# fqiifpriirrit l« ai ivturr, ■* OJA rr v t/j d* 
irsfumsible FOP 

* (U//FCHX)) f r mfilrlr ihr appf upfiati- * rompli >hmml v wrthm (hr * r /xnpf j rfwnntts 
module of tlte FBI s « rrHiaJ reconfceeptsg system for OCXs wi'« Udi 

* (U//FOUQ) Cotrgulrir the appropriate < KS Report J>?cuninjrt „£^i<3!jv A 

m rompli&hjnml report fm CHS*) 

* (U//FOUO) Ensure all C HS handling aid oprr^iicm it m cxunplia^ <■ a yd dir 

Cfrq/kftttffrd <hadjf (&V&PG} 

* (Uf/f OVO) Work with OCEs UCEs aid CHS* to identify *«e« the $t*obibty of arri 
validate otfirr individuals wIkj may be remitted k CHSs online 

■ (U//FOUO) If the OCXs UCEs and/or CHSs me ptrmaudiy tliiiwl ill i nnriumf 
operation 1 * within another FO s trmlor> the contact a pert must havr doosovrtrd 
concurrence 6oni all of tfir involved FOs 

* (U//FOUO) Keep the case agent apprised of infonrutioti ifr^amnp the opctatiGvs of 
other FQs andfor government agencies djat the OCE UCE and or CHS ia supporttop 

■ (U//FOUQ) Coordinate all requests for subject targeting with OTU 

* (U//FOUO) Ensure all OCE. UCE and CHS online idealities -opporrm? CT 
investigations are entered into the Net Talon Database and iqxtaird e necrvsarv 

* fUi'/FOUO) Protect the identities of lU OCXs UCXs rod CHSs for * boro they are 
responsible 

(U//FQUO) Note: CHS handlers most abide by the (fryfopma; Hu , > . r * Pobnf , \ 
Guide f0499PG) . which has priority over this docitmeni 

* (U//FOUO) Linguist OCXs mast provide written feedback on their pe tfiatnimre to L&S 

in coordination with the case agent Rrfn to sul •- r- of tha,*- PC ia additional 

ujformation 

* (U TOUO ) Be familiar with and. as appropriate use the Checklist for Aperts Handbag 

Online CHSs provided on the C TD Templates Page . 

Cdfi, (U/riFOVO) Undercover tuiplme*^. 

(0) A UCEs responsibilities with regard to NTNI are as follows 

* (tl TOUO) Successfully complete specialized uauung deemed ap £5 operate bv CTTL" 
and oi CTUC in addition to the required standai d UCE training 

* (UTGUO) Follow taking and guidance from the co fl tacf aged who has hem amiyrd 

to the FOP or SO 

■ (S//REL TO USA FVBY) Assist m identtfvmg assessing the mfldwlify of and 

validating poiermal CHSs online 
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* (U TOUO) C oordinate all request* for fubjec! Uipctmp wilJi the iuiUiH apml who will 
then root ciniair with CTTU 

* (S REL TO USA FVEY) F j™r all online identities CT investigations are 

entered mio ti» Net Talon Database* Mid updated AS bMXttary 

(C'TOUO) While certified UCEs may work in an online role lliey will also liave the flexibility 
to handle f*re lo fk:e physical world operations againM (fee sub] eels of die NTN1 

a TOI O) Onbtte C overt l.mplftvws 

(U) An OCEs irspousibdities with regard to NTNI. are as follows 

* (Li TOUO) OCEs are required to successfully complete spec lal ized training deemrd 
appropriate by CTTU and w CTUC in addition to the sundud OCE framing 


• (D FOUO) Follow tasking and giudanrr from the contact agrnt who has bent assigned 
by the FOP or SO 



• (S REL TO USA FVEV) Assist m identifying assessing the suitability of and 
validating potential CHSs online 


* ( vm TO USA FVEY) Be available to testify concerning the OCE s online covert 
activities if an investigation goes to tr ial If the OCE is unwilling to testify this may 
preclude the OCE s ability to tar gel certain subjects 

* (IT TOUO) Coordinate all subject targeting requests with the contact agent who will 
then coofdtnale with CTTU 

* ( S R£L TO USA. FVEY) Ensure all online identities supporting CT investigations ate 
entered into the Nel Talon Database when they are created and updated 

FJJ. (l TOUO) Cod fide utial Human Sources 

fU TOUO) The following policies must be followed with regard to CHS participation ui the 
NTNI to addition to the general CHS policies outlined in the ( mfidirntml Human Sourrc Policy 
Gwd* fP499PGl . 

* (U TOUO) The NTNI utilizes CHS* in FOP* and SOs in order To respond to 
investigative priorities and FBI intelligence colled ion requirements 

* (U TOUO) Intel h grace collected from CHSs may be disseminated pursuant to proper 
dissemination proceduies to members of tile intelligence and law enforcement 
ccmtrrutnities id order to support die USG’s national security and law enforcement 
objectives 
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* (U//POUO) A C HS Will t ollert rnforTnatviff on ifor NTNI urvesfigrtw pnotftie* as well 
as assist in identifying IMBg dir suitability of, ml validating pctfmtial HiSi 

* (IJ//FOUO) I l^anHJirip agents muic* ptotrrl tbr idrnlttjrs of ad CHS* fm wbom dirv are 
responsible 

* (U//FOUO) A CHS nwy br irqmrrd to sign a nofjdbvck*H*e apyrmriH to p tf** 
malm nature of his <w her relationship within the NTNI and to avoid ^(^rndump the 
effectiveness of the operation 

1 7 .3 .9. (I I//FOI O} t a w Agents of Sulif *<rf t I *r prid I In no eh NTM 

(U//FOUO) Tlic case agrnl of a subject tiugrted through NTNI provides dperaftuKiaj m rrugf* of 
all aspects of an investigation regarding that subject specifically 

* (U//FOUO) If dir case agent of an NTNI subject nrrds MWtact idrrtifymg tbr 
appropriate FOP he ot *Jie may contact CITU for information regarding (br rjqialAhtie* 
of eac h FOP 

* (U//FOUO) To request assistance the case a pent of the subject coordinate* with the cave 
agent of die FOP and submits a formal request as stipulated by the FOP 

* (U//FOUO) The case agent of an NTNI subject provides the POP with wfaraat km about 
the subject and participates in the developmoii of an operational plan 

* (IWGUO) The case agent of an NTNI subject ii responsible ft* providing the FOP with 
feedback regarding die usefulness of the rrp** 111 ^ generated from the mvrsti ration 

■ (U FOUO) The case agent of an NTNI subject in coot dotation with the F OP is 
responsible for disseminating the mtrlb pence generated from cbf activities of dir FGP 
that are pertinent 10 the investigation 

173.10. (1*) Olbei Goi eminent Affncy Partners 

(S' REL TO IFSA_ FYEY) Recent FBI efforts to investigate terrorists use of dir lurcmrt have 
prided excellent relationships with USIC partneis and have resulted m the development of 
numerous joint operations with OGAs w international partners Upon request the NTNI mav be 
utilized to support OGAs. both uitemational and domestic The following factors mnst be 
considered when determining whether die FBI will assist aitothes govennnrm ageno unluung 
dir NTNI 

1 (UtfFOUQ) Situations m which the FBI or the other agency senes as tbr primary prom of 
contact with die OCE. UCE and or CHS m the im-estiration 

2 (U//FOUO) The degree of contact the OCE UCE and or CHS ii tamtams with the FBI 
and Of the OGA 

3 (U//FQUO) The prion rv of the target 

A (U//FOUO) Situations in which the FBI direct! v tasks the OCE. UCE and pi CHS 
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S (t i 1 ill H)1 Siliulintw hi whuli a. jwtilik idji oficialiiiti |wiiiM9ilv <«u|^hwU j n|ir* (Ac I ilJ 

fflVT Jlhl i M pid iH ollH'l hvr 

(t KM t U Ilk 1 N TNI *orks nt uiili/r other jprtii tit irwmn r. when im r>WAi> irt Hit- tlUMl 

elliririil riiaiinn 

1X4 (11 Stt I ulnii IK I I ingiilvt hufltim 

[S KM TU USA FVEY) the l>1 * t SS/I aii/mage Sfivurt f i jh^Ijchio f cuin (Uflt) tnvrt 
is the i mfi al u'mdiiulM of IlfMt support to the 1'iTOl and irljlrd mvetfigalHMis by 
identifying Ungmrt* in tnvr u Of T t 

I " 4 1 (11 ItagWkttHg I ingiitrt Mippmit 

(S SH TO USA FVEY) When an UOP« an SO has a tired for a linguist to ail as an OCE m 
ait NTN1 irUtrd uivntipiiigQ i(»r casr if»mi mutt ■ ixit»i CJTU and CTUC for an ttuiial 
discussion and an evaluation nr ihr iequrrt I anguist* will NQT be approached bv tbr FOP or 
SU mil and CTUC will then nitllOf lllf irquiirtTiniis fa flue operation in an I X lo the 
appropn >le LVK fa asstsLuvi c 

(U TOl ’Ol 1 -SIX" catnwsws FOi in onln to dnntiunr tlic availability of linguist* with die 
required language ami suhfeil mattn vkiU set* to si^ipdrt such a request LSTC will then provide 
cm : and CTUC with the tumml of the identified linguists) Any changes or modiftraliom to 
the initiaJ irqorsi fat support must foe cleared through the LSTC to ensiue that top Hi l pnontm 
imutii covered 

( Ml (U luming AmiSafrpiai d 

(UtfFOUO) 1 mguirt OCEs ait icipmH to meet all training and safe guard w ^smnu 
sftpuLatiotis set fordi in syb- lion HO ? of tlu* PG 

1X4-3, (|T) Qualm t mil ml 

■ 1 FBI are subject fo USS s quality control process drier 

m manned to have sampler of then work reviewed 
in Quality control will provide an additional backstop to 

ensure that complete and correct information is being conveyed to the Net Talon case agents 

(V TDUO) Given the sensitive nature of die UCO materials C1TU Will coordinate with the 
Qualify € onUo) and Standards Unit m ISS to ensure dial appiopiuie work samples are 
submitted bv the contact agent in coonhnation with the case agent for quality' control review in 

a predetermined time 6 ante 

I" 4,4. (IT Required l eetfbatfc a« IjUfUlM Performance 

CL FOOD) In otdei to effectively gis e feedback to luigumt OCEs fix progjess reviews 
performanee appraisal reports, and annual work reviews the contact agent in cocnduiation witli 
die case agent may be asked to ptosyde written perfomiance feedback 
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(UmjlJD) i fiigntst 1* t a \utvr (hr tipi* m witfwbjMr 
prisoruJ m firDirwuJimJ 

(UMNIUO) If * *IV F^«I< f ITU < 7"Uf dnetw 
*ri (hr <X'h \ahwmu < N f auflfai ( ITX wvD mi ‘* r 
JJFTT re*?»uvr% j JmgunM fcoM dir OCR ptifMB ba 
imparity will hr HU lied to #jr ImjWiKi m ffrMttmt 1 
other NTNI jssijpirumiU 

17 J. (U//FOUO) N*t I al.m M«f 

(S/flUX TO USA FVEY) To dir need (a * 

within dir FBI CfTIJ hai uirrj tbr tod and as < rdiah 

1 1 nlebr & 



THu^M^^^irrrd into thr daafcay f« purpose* of 4a 
piopiam rTLaruprmml of oriJinr HUIfflfl I hr liar ■ 
\iotrd in I hr mlrm noh tbr vvnbd mndin mrnd p* 
available FBI wide to detemifiir if an uoioKwo onhsr 
andor loreipn fovrmrnf*il equity 

(U//FOUOJ Thr ipee tfh purposes for thr Net I aion D 

* (U//FOUO) Providing a real tmvr drcufifbrhaa 

FBI us tt% 

* V/XELTOI Cresag a cumprehi 

identities las prtmp fl mvestipirims inrhuhTu 
and pseiKfofivms 

* (S REL TO ISA. FVTY) Cicaimi? a centime 
that will capture lanpiujpe ahtkbr* rufruraJ and 
diat can be used in idra&IVuiF dir jppr uproar re 

Pii, fl ) Enfutuunoa Stotrd to Net T *k#n D»U 

(S TILL TO USA FVEY) Tbe trur man of OCE* U* 
dir database Has includes am approximated informal} 
dial would reveal thr trur idmutic^ of these mdn-tAiai 

(STILL TO USA. F\ETl Characimstics of tkr wix i 
be entered into the database as the pi ofUr Flue miom 

* ft" FOUO) SstnboJ number 

* (U FOLD ) T vpe (OC£ UCE at CHS 

* fU FOUO) Originating FO 


SI i HI I '/NOFlrttN 
fl 0 Cmiotntrmniiiro IV»Im -y (mule 


* (V'TCH'O) Apr intipt 

* (IR/FOUO) (kudo 

* (I' lOUO) Skill sets (c p Languages cultural kmwlnlgr irgimul knowledge 
edm Him hobbiis rcligpcm) 

* (Uj TOW) Ethnic background 

* (U'/ftXJO) Re&gum hadtpound 

* (U HMJO) EaqxnoKr (r p pasi Hiqiloyiunii . education. travel) 

* (U TOIO) Investigations ( file- tmmbfis of current a nil previous investigations on which 
the emplowe lus wuiini) 

(SREL TO USA FVEY) Infonuafion i elating to the online identities associated with die OCE, 
t ICE ot CHS must be entered mto die database as pfenoaii This mfomntion is linked lo die 
profile page and will include die following 

* (U/rtOUO) Fetsona name 
(IJ/.EOUO) Legend (see 

* (S RLl TO USA FVTY) Facilities (tvpr |e p e tiisol instant message (IM) blopj 
moniker screen name legend creation date deactivation date) 

* (Ur'/FOUO) Creation date 

* (U TQUQ) Activemarnve 

* (U FOLIO) Destination date 

(S REL TO USA FVEY) When available USlt and foreign partner online information is 
mteied into the database 

(U/ TOUO) CTTU will have die abLhrv to add additional selectors to allow a more accurate 
representation of dir skills and characteristics of the profiles and personas 

(IT) Levels of Access 

(U TOUO) The Net Talon Database allows FO in vest jga tots two lev els of access dependent 
ispou then assignments with a third level of access reserv ed to program management personnel 

* Lev el 1 (3 REL TO USA FVEY) Access is av ailable to all users With access to die 
FBI lnuanet and does not necessitate a user name and password It allows for simple 
bruited queries invoking source identities. rnrhiding oubne screen names, monikers and 
e-mail addresses Positive results Will be noted but not detailed and only a point of 
contact for die conflicted source will be provided 

* Level : it FOUQ) Access allows case agents and selected investigative personnel the 
same capabilities as Level l access widi the added capabilities to edit and add data 
Users are onlv able to access records dial ibey have created or to which they have been 
delegaied access 
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* t i-vrl 1 fUf/FOI JQ) Arc rts in irsrivrd Un qptt rfirtt f IT ! I prt 9rinr*rf zwunvrl foe 
irspuritilnhly of riwfiiLiiriinf' thr jMrp?ity arid arritf * y *)tf llir database Tb>- *r r rv. 
allows ( Til J Ihe aJwhl y (o emror'lulr ly iragfc h identify and ab M* irvmar r% that *rr 
rum' suitable U* 4 particular KJP 


17.3*3. ft f ) I nlei niL r and ( pdaluig IpNinilmn 

(S//KEL TO USA, FVEV) All QCE», UCE* awl CHS* importing IT inve-tfj *e teq»to*4 

to luvr pi ofiJrs Willi thru personal <T lanrtmsttct created m Ur database ft w fcrju**vi irua 
every online identity anotked with an CX 1: a UCT. mi( US -j^pofto? tt nrv^ip^jofx be 
m tried into the database when thr profile andof the idnitil v ti circled 

(SWREL TO USA FVEY) It is thr iryporortwhiv of CTTU and thr FOP to rondurl rnune audm 
to ensutr aJJ profile and pd«u information is rwirtrt and arrurtor Hue dlirrute froporatbiifiy 
fur ensuring tlui all profile and persona infer inatton is rotrrrd and updat'd to (be database to a 
tm it* l y fashion is thr irspoftsibihtv of ihr case aprnt 


17.5,4, ft) Requesting an Am ount 

(S//REL TO USA. FVEY) Only users who are required to ratte r infaffmannci hu fee deb ase 
will need ,io account To request an at fount send an e road to I 
Uir following information 


* (U//FOUO) Name ( first middlr initial East > 

* (U//FOUO) Tnlogy login 

* (U/.TOUOlEmplover type (agent analyst contractor linguist ocher) 

* (U'/FOUQ) Supervisor s name 


* (U//FOUO) FO 

* (U//FOUO) Ptione number 


■ (U TOUO) Justification iot needing an account 
17 (k ft FOl G) Other Set Talon Policies 
17.4.1. (V) Targeting Priorities 


(Uf/FOVO) The subjects of the NTM will be prioritized according to the CTD ■■ n ui (refer to 
subsection 2 3 of this PG1 and oth er relevant s trategy andol Tjrctrve mn dance irefer to| 


1 7.6.2. (1) Subjects Targets of the MM 


I V REL TO USA, FVEY) The target of an NTN1 operatstw must be hr predicated subject of m 
ongoing FT PI ot full investigation 

(S REL TO USA FVEY) In otdei for an OCT a UCE or a CHS to vwi taolroev such m a 
Web site message forum, blog or oilier Inirruet facditv that jcnvify naisi be rein ant to a 
predicated investigation tor die purpose of obtaining sobstartoiT mrelli grace evidence on a 
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ujhfrct of xn investigation o* ft* I mi Ming bona fitfc k \ IXmiip. all aiiOum/rd vixil -in (K'l; a 
IX 1 «* 4 CHS mj\ identify uihn subject* tfiumgh pmaivr numtu mug, ot ariivr rommimicadon 
011 die se Web Kites 

1 S' RFC TO USA FVEY} (rmununir alums with a nuujtmlu ated individual t annul lie dniprtrd 
Ip collect ndrlligraicr on dial Donpreduiled prison Jf ihnmgji building twma fidra, m votlrt ling 
intelligence on a (Hfdu Aln! sub|ril an OCL a UCt ; . c* a CHS mlnihlir*. an individual who 
mair- 1 . sraiemriils tfiai jnnfivaJc dot person ** an FI’ subject dim a PI i* a lull mvestiRation fflut 
be opnini on that individual to continue under i over consuls drsi^ftl to colled intelligent r or 
evidence on dial individual 

l S' R1J TO USA FVEY) OCE, UCE, and CHS reporting must slate die teasexi foi dir 
ctnuimuucAtu™ (r g let budding bona lides oc to communicate with a (Medicated subject m m 
associate of a predicated subject of an invest! ganoid ami how tin- romniumratioD is relevant to 
the mvrstip.adon Foi example. if dir reason for the communication is to build Ixma fides tlr 
reporting will include language similar lo the following Online activity conducted foi die 
purpose of budding the [OCE s UCE ‘s, or CHS s] bona fidrs In tins example this slatcment 
must imludr bow dir rotmmni cation budl twma fidrs and may not be a mere ccmclusory 
statement 

(S REL TO USA FVEY) If the leasoti for dir cimimtmication is m fiulhei support of die 
captioned investigation, the reporting will uirlude language similar to the folio wing ‘Online 
activity conducted with the purpose to fiirthei support die captioned mv 'estigatiQu(s) 

(S REL TO USA. FVEY) If anv individual^ s ) laigeird online is confirmed lo be located outside 
the T inted States notification will be provided to die appropriate Legal and die CIA This 
notification will 1» coordinated through CTIU 

(S. R£L TO USA. FVEY) Under certain circumstances. OCEs UCEs and CHSs mav be m 
contact with individuals who are not the subjects of predicated investigations {such as for 
building bosa fides) Id accordance with the DHXi (see dir subsection on authorized 
investigate methods in assessments and predicated investigations interviewing and requesting 
information from members of die public and priva.tr entities) ui or der for an OCE or a UCE to 
engage au individual for die purpose of acquinng substantive uitelligenceuifcnnLXiPfi about that 
individual and that individual g activities the FO must first crpeu either a PI or a fill! 
mve 1 tig.it ion on dial individual Tlus requirement does not apply to CHSs In accordance with 
the DIOC section oa the use and recruitment of human sources. CHSs mav initiate online 
contacts with subjects of assessments for the purpose of acquiring intelligence about (hose 
subjects and then xh vines The specific authorities of OCEs, UCEs, and CHSs are outlined as 
follows 

fP) OCE wd UCE Aothorlftes 

* (U FGUG i Whoi the purpose of an OC E or UC E initiating communication with an 
individual is to acquire substantive intelligence about that individual and that individual s 
activities the OCE or UCE is engaging m undercover activity and the FO must first 
open a predicated investigation before tlie OCE or UCE may engage in such contacts 
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(limit JUj Of# r 4 fiirtbr atod mveUigaluivj i* *iprivd on j «ib^rt ^ h of j f Y 
nuy mgaftr in '■dimited ouxaxmarv Myx/u wtA jp-vm uln of tfeal {jiHjrjH ijjrr t ft* dir 
|mU|)mm of pauiing additirmaJ irrtdhpnw r or evident# mi (he pirdif alrd vjbjrri 1 

(U//FOUO) However. if the OCTi « UC I suI*^ftirntJy develop! ^ff* * 1 * draft* #r 
mfofTfjatom irgaidifip th# ute and ttM* purpov* *if the 1 ommueiirat#*. in 

gather tup trilelliprrir r rrt evident:# an tbr jsv* mte dud jrv/ uli* m/4 V pt jnW ^rd #*, 
Uir subject ml an appnjfjriatr investi paijrm ptwm to the DTE dr fJCE 
mtnmunratitw 

(U//FOUO) F or ihr jmrpose of establishing bona 6d«** and nredbbifofv fjf I . mA ’X t * 
nuy iibikr postings and t ovrsminirair with uidividuak who are neither ihr ^jfoerts or* 
ihr auorutfs of subjects of assrssrrirriK or piedi rated irrv e^tigaurirv Ho« m HO 
hnuuiirm wiili resprrt to ihr amount of r ornmunx -aivjfi an (X f or a T itm Emtuir to 
this regard 

(S//REL TO USA FVEY) If postings «r made to rsuMuii bom frdrs on a mrvta^ 
forum and (iir porting f«flv« responses hum other forum ssrrs through rtfher another 
posting or a direct online ronuri die OCE or UCE may coomiMacair with that y^a it 
rocitimie building bona fidrs Oner predication is established writ ihr jsa orjtartuip the 
OCE ui UCE. a PI or a ftili investigation must be opened before the 0(1 or \J f. ma 
continue conttiuiiijcaiiijp with that individual 

(S//REL TO USA, FVEY) In order for an GCE at a UCE to target a Wet yuc user Aimat 
comminuc attorn mcbcal#’ the user is involved in miernabonat terrorism ao appropiiat' 
pr edit' air d investigation must be initiated See the able below rrgjfdm? author szed 
undercover r on tan for UCEs and OCE* 
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Nature «f C^atxct 


sit Ki I rvnioKhi 
(10 CVninleT triri *Msiii l*ul* y < tilKle 



Nature ut 1 iigrf 

Tauget is no* a 
subject of a I 1 ! or a 
full invrslipjalion 
(rji witness diuil 

party) 

1 argil ih die 
subject of an 
assessment 

Taigrt is dir 
sntrjrcl of a PI 
ih a full 
investigation 

Cofttart to obtain 
intelligence about dir 
target 

No 

No 

Y« 

Contact to maintain 
ixrvei and credibility 
only, not to obtain 

Ye 

V« 


Contact to obtain 
intelligence relevant to 
the subject of a PI or a 
hdl investigation 

Yes 

Yes 

Yes 


Tahk 1 (V'REL TO I S V. IT EM WVfl Oftli*? I nilrTfoirt C otaf arf i'. fat 3,0 GCE »r* ICE 

(V) C HS Autb on tie s 

* (U FQUQ) The term undercover activities does not a.pplv to die activities of CHSs 
The subsection of the I>|QG on authorized investigative owdiods in assessments and 
predicated investigations to use and rectuil human sources penults [lie tasking of CHSs in 
the course of authorized assessments Therefore because CHSs are not under the same 
restriction as FBI employees with respect to the lequiiemeut dial a predicated 
imestiganon be initialed prior to target uig an individual a C HS. unlike an OCE ot a 
UCL may be tasked in an assessment to acquire substanti ve mtel licence about an 
individual and the individual s activities Howev er before an FO may target an 
individual and task a CHS to acquire intelligence concerning that individual an 
assessment must be initiated fot an authorized purpose pet die DIQt> (see die section on 
authorized purposes) 

* (U FOUO) Once an assessment is opened on an individual a CHS may engage m 
unlimited conuituni cations with associates of that subject for the purpose of acquiring 
additional intelligence or evidence on die subject unless prohibited or restricted by law 
regulation orpohcv 

* i U FOUO) However if die CHS subsequently dev elops information regarding the 
associate that permits at least an assessmeni to be opened on die associate and die 
purpose of the cotumunicanons is to gather intelligence 01 evidence on the associate die 
associate must become (at least I die subject of an assessment prior to die CHS 
contuiMLinf communications 
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Nil til rr of Contort 


SI i kf 

(!/) f (Mriiflpriwnn f'ub' y < jndr 


* (l !//|*C HJO) I ci* tin- «f r-j^bir.hirip boeu fide-. +i*\ 'f-ddnht f CM - rruy 

Jimllllj'* 4fid < cnrimFiriif air With indfuidaiih who mr m-ilbet thr jdn* F *’ nt& #se 

jsvtic wU*s of subjects of iviriMmil'. 'if pirdicalrd wivr- *i|txtir*rt V*ir iv mr InrtfUlv ' 
with isipert to tlir -ajMimii of t Xflmvi anon j CHS owy mrtutr m tta% rr ?*rd 

* iS/fRH , TO t JNA FVKV) If 4 ptwtnjg is made on j message to ettaMiili ^jru 

iidf% and thr potting irt rives rrsp-rjme', from otlx-a hjrucn usac thrc*ie)> nthur ■v*hrr 
poviirip w 4 duert ctfilior conLirl thr C HS ti»> t tmnufii- Jto with llutf \a*i to r ***** 
building Ixma fidrs If an xudsuti/rd piny*#* for 4 n adr^.unrtrt 40 aasrvvmrra 

must be initiated brforr thr CHS rutitomrs to have roc Kart with Thai todtvHfcul 

* (S//REI , TO l ISA I VEY) in ordn for a CHS to Ltfprt a Web wto uma vfane 

Lofimiuint atians indurate llir user is involved m nilrTEixtu.^u] wnmiscri m. aud wurd 
assessment (at least) must be initialed prior to thr CH 5 aortutmi* c ornottfiar at-.- *itf 1 

tliat user 



SltuiP of I Ji«rt 


Target is not the 
subject of an 
assessment a PI or a 
full im estimation (e g 
witness thud parry) 

T ar gel u thr 
subject of an 
assessment 

Contact to obtain 
intelligence about the 
target 

No 

Yes 

Contort to maintain 
cover and credibility 
only, not 10 obtain 
intelligence 

Yes 

Ym 

Contact to obtain 
tnieUigence relevant to 
the subject of an 
assessment a PI or a 
full investigation 

Yes 

Yes 


- 


Targrl m tbr 
subvert of a PI 
of a full 
nc, na&lion 


Yet 


Yes 


Yrs 




Tilth < (V I? EL TO I SA. FYUfr Oatui# t oA-ft^ee t **!wr e A wtk*i uri few 1 K 


17,6.3. {C TOl'Oj Online C o mm uni rattan 


IS REL TO USA. FVEY) An OCE miv engage in oral cornrmimeatoat^ mdudme telephone or 
Voice over Interner Protocol (UoIPj with tbr approval erf tfc< 



14? 

SEC KIT NOEORN 


SK Kl 1V/NOI OWN 
(l/) I is minim "t ism Fobcy < niiib* 



r.0 4 (I lOllimu^ Ill^jil W tii ill. 

(IT rnrt» In coordination with NSD s CTS and llw 4 NS1 Jl CHTi nuudamf iiiiMi.il blanket 
GlA juthciviztfttons foi .ill FOft under the MINI New POPs an* nut fovnrd by this OLA until 
oftii idh notified bv CTITJ CTTU is lesponsiblc Lot annul renewals of dirse blanket OJA 
aiithmi/a butts AIL OLA nmst cease al llir etfcd of (lie authon/ed jx-i hkI unless time is wnlten 
continuation Lh.ir the OLA has been exlended Ibr following fiiitlrlmrs will be followed by tile 
NTN1 in MffJitd to OLA 

\S RFT TO USA FVEY) As requited by Section V C of the ACKi I>om Section V of JV 
m jrf;irr.f\- ti'i'if' ,v pta fainas inijg th<f I 5# of FBI Confid*ntt(ll Human St mn , tlie 
ORKt dir t v - 1 *1 Sotirre Polity G wd* (Q4 99PG T and ibis PG, FBIHQ will request 

appt opnate AD and DOi authorization for participation ui OLA diat caunor be audio! t/ed by die 
SAC ft* all FOs involved ui the NTN1 (refer to nibscc lion I ' ? ) UUO* that transition from 
strictly on lux' to face to fare urn leqtuie OLA amhotiTY separate horn die blanket NTN1 OlA to 
protect die sensitive method of targeting rjcbeinists online 

till Applu atimi Process 

(1! FOl'OTi 014 anihoutv applications must be coordinated with CTTU and N5LB w ho will 
w ork With NSD s CTS to obtain OLA authority 

* (tl FOUO) As each FOP is approved die case agent mm t concurrently apply for die 
OlA autlioiitirs under the NTN1 The FOP will only need to separate I v apply for dime 
authonties that are not included id the blanket OlA 

* (U FOLD) OLA authority applications that will benefit die entire >TrNl must be 
coordinated with CUT and NSLB 

* EU FOUOT Requests for emergency OLA approval mm t be handled in accordance with 
the DIOG for FBI employees and ui accordance with the Artonw Gerimdl 's Guidelin es 
Rc£>trjri £ fir *- 1 Vse of FBI Conndtnyfiai Human Source* (AGG-CHS) for CHSs 

* (U FOUO 1 At the end of the period ten winch the OLA was approved, die case agent 
must cease activity until written confirmation is provided by CTTU that OLA has been 
tenewed Without written confirmation diat OLA has been authorized for an additional 
period on the day that OlA authorization ends, the case agent must send written 
confinuatioii to CTTU that all activities for win ell OLA is lequufd have ceased 

tl 1 Repoi ting Reqiiuemeiifs 

I'U FOUO T Below are the reporting requirements for the use of OLA m the NTNI 

* f L FOLD) Before an FOP utihzes an OlA audio* m the case agent must notify CTTU 
No further action wall be taken until CTTL provides concurrence Tins allows C ITU to 
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SM HI |//N«if OKN 
ft/) C maite* IrrrirtiVfl Pol*/ /fXd^ 


tiiMiir Out Hill w* tiMuy aajfbrf itirs are in pbre ptum Sri <-r»p y trtsi* m * JIA tt Mi fJ/SA 
memo aulhonjin rnulttplr Mhvrbrs the I Of mu <3 rimdt wuh t rfld pi*af u* iV first 
instant r of r<v 1 1 m livify flnv tvAtfv: Mujti Mid * otifirnnrx m may he done n* r nul 

■ (U//FOUOJ f ontart agento rnucl dr* ?*nrnf ail tv-o^r f rf OIA lo Or f OP . W>i wtWiir at 
specified in dir pfocedntrs Melton of dm Ax 'jurat If Ox- FOP w inmp * arfrytry 
AUlhm i/rd by fhr Of A fur thr fir <4 tune dir rcmUirt ifrat must refererxe i/rl Ax ■ *;#•?* 
tlir POP's pnof roordmauofi with CTT1J 

* (U/JFOUO) Tlie case aprtif must p< 7 iiodn aJ]y provide CT! r *ifh a t*«v 

the OIA authutities ulthzed including a brief drvnptKri of frr ittagr and the fX xtui 
ruuiilrr As IXJJ require* a 90 day repeal on FBI OIA acirvtfm K>F is 

required after an initial period of 75 days 

* (U//FGUO) Every 90 days CITU sm** wnir a leporf y^irtrere®*e die KTNI OfA 
authorities utilized 

* (U//FOUO) If an FOP tt authorized to ropy? m OIA outside of thr NTNI OfA dvr f OP 
must rorapile a report summarizing die t»e of that authority to be provided ckrectl v to 

OTU every 90 days 

* (U//FOUO) OTU fat wads OIA reports to NS© 1 CTS far xr-.x“* asm^es^ar, 

(11 Usage of OIA AnMdH In t moreover PeivonuH 

(U//F0UO) Below aie the limitations on the use of OIA by GCE tzC£. or CHS pervaond 

* (U//FOUO) OCEs. UCEs and CHS* of the NTNI mav utilize Che NTS! i OLA kzi. 
with proper documentation of then status as working wnbm the auspice* of die NTNI 

* (U//FOUO) All parhcipaiioo m OIA oral be m accordance wuh *r C» PO and tf* 

AGG-CHS 

1 7. 6, 5h (U) C ! *s %i fi r a 1 iod ( ,u 1 debit* s 

(U 'TOt JO) All documentation generated by personnel from the NTNI nneJ adhere to thr 

NSlCG Tbs includes but is not limited lo 

* (S REL TO USA FVEY) The protect! on of the sennit re method of targeting an exiremKi 

Web site or online nenvork (refer to sidxccooc 9 B I 

* (IjV/FOUO) EC doeucnflinnon of all acir.it- :ooducted bv OC E* I 'CEs and CHS. ttdrr 
die audiortties of the UCO mdudmg analysis and rosmaents 00 the mfonnatiQci /ollet^ed 

■ (U TOUO)FD-ld23 CHS Reportmg Document ml iln iBiaii da mi fmm 

information provided bv a CHS 

■ (U TOUO ) V erbatim translations of air* text 

* (C FOUOs EC’s penauung to subject tarpetins and taczetuifi stratepes 
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M I HI 1 //NOt l*KN 
(Tty t ointatarortam P«l*t v Chiulr 


|7.6ft (11) |*i H^n tilion (itiidaihf 

(1 yptH.JO) All invrMijutiitm thai may lead in ptMPtubufi mi mi lx- < tmidmalrd with CTR/, 

NS] Ji NSR h Cl'S uii L the investigating I O i USAQ 

R17. (!i) Altonn I corral EtwpttMl 

(U//F0110) A* wiTsuuy. all FGPi arr injuiml u» mdivnhMllv ofrtam ihr deposit of funds. AC? 
exmiptmn ihioupjh tTTU and CTUC Adtbtnwial AG miiqiturri appl u arum* nnntt hr 
ooc n A n afed with CRU CTUC, NS LB, and NSD a CTS Krfn to Hit < imjhimtml ?>vwtmg 

mma 

I? Aft (U) Training 

(U'TOIJO) AU CX'Hfi and UCT-s. fm an FOP air irtfimed lo meet with die FO undricovn 
program AS AC six months All OCEs and UCE* Air irquunl lo pass dir safeguard 
asscssaiirrii and (hr appt inmate OCE or UCE ceitificaUoii course befote brcommp opeialionaJ 

(U/TOUO) In exceptional nirumstancrs a nonortiifird CK i m.i^^isedogrraiirmj^ as part 

■ 

(U//FDUO) Select NTN1 pnwmirl u* ludmg rath NTN1 FOP case aperil air required to attend 
animal NTNI framing sponsored and hosfled by CTFU As tier ess* y FOPs will tw irqiurrd to 
provide peivotmel foi training courses sponsored by CITE and CTUC 

(l> FOUO) It is irvomnirnded that rath FOP schedule a training c unfa tote for its personnel 
approximately six months after the annual NTNT training A* tins time OCEs and UCFs of the 
FOP must bring aft of thro UC hardware to tlie conference for inventory purposes Attendance at 
these naming conferences must be documented ua EC by the FOP 

(S vKEL TO USA, FVEY) Typically, CHSs will not be allowed to attmd the aforementioned 
naming courses and conferences for operational security reasons As additional framing becomes 
available contact agents may be asked to attend these I raining courses and conferences and brief 
CHSs on the be*d practices for online targeting For CHSs beginning thru participation m NTNl 
operations theu online activities may be corroborated by checking ihr mfomiaiion they prov ide 
via OCE or reliable CHS verification and or through open source and FBI database checks 

17 A®. (Ity Sa fegu.il d Avvessmeols 

(U' FOLK)) A cunetu safeguard assessment is required for aft OCEs and UtEs prior to 
becoming operational in accordance with the NSUCO PG OC Es while operational are also 
required to complete an annual safeguard assessment L’C'Es wink operational will be required 

to complete a semiannual safeguard assessment 

I 7.6.10, (l) Consensual Monitoring and ELSI R C oiler tion 

(U FOUO) For basic rules on consensual ruointormg refer lo Section 18 of the DIOG Below is 
additional guidance specific to the Net Talon Program 

(U TOUG) UCEs or OCEs must complete the consent forms ace tnduig to tlie utstructiotK listed 
helow CHSs must coinplele the consent forms according to the imtnictions listed below unless 
contradictory instruction is given b> the CHS PC. m which case the OlSFG must be followed 


Ida 

six Ri r ‘NOFORN 


tit/ m r irsitt n 


(ItylM 


(UWKJUO) ihr tin#- n*/n* of thr (0 1 or LX f Jin* nrK \* 
lihirjjl llir mslinr alia* of tyjrfad tawrdiei pi iiwJ 


p Ft> 47 ? I 


Of T. i nt f IS If 




• (U//FOUO) Iht f rifiLMi Jgffir 4Jwi vvtiftrt Ar UCE 
rvli form fm kkriUfc aluin purpoort 

• (U//POUO) In (Ir addre** Md tfv fO kx**m when* tit n&vtfei ■ 

• (S//KJ-J, TO USA FVEY) UntiJ Mrh bur that tbr FD-477 torrn coirai 

potmnf; In rkf tinfiii * uriserHaud nttmtorm^ dir f ootart ag*a* h, 
itir- limits to ihr rffrrt of Ihr aridfvidujl pvn r uut e nt for 
rucxutofiiif' of hilt or bn #rti vdm to inrkidr r mad 
posting private and VoIP 

(S//REL TO USA FVEY) Lot all OCT UCE and <"HS cottorln Inner < jptmr wh *#r 
drrnird appi opriale by OTU nniil be used to coHecl all «f«eu tbnh r math per 
and Web posting activitm Additional softwwe is wrd to coftrct mutant m iigir ar» 
TOPs may Ionian QTU tot puidamt roartmap ch r aptxripruMe software 

(S//REL TO USA FVEY) DIOG SctIiog I % stairs that ail rwot dmfs pmnMton 

be sroied in EL5UR Therefore all one to oat c mt* mrv short a t«ga tarkaAmf 

■ omnium* -il 1 J i ;■ 121 e mail chifda&i mrtapl mrsta^iD^ pr 

J I LSUR va dr [ 

AH njnenf tLSV. K pgtarje* CfUM Ml 

DICK, and 

IT7, (I ,i Proffdiirn and 


1 7 , 7 . L (l’) Working with Other Ui fimnt Aftacie* 

(U"TOUO) cm; will coordinate all joint operations with OGAs nad 
will give final approval foe the use of routracton m an 
notified whenever information nmk to be passed to OGAs 
contra* tots 



(V) lin eMigaln t I Or Vlndvn 


(U TOUO) As appropnatr FOPs wdJ use standardized subfile aocraciarje *ct krtb k I 
NTNI winch will be in acrofdanre widi (far standards otfbaed m Ae DiOG Each FOP ml 
an FO 41 5 file in parallel to the NTNI unnrmgjnve file mmdf i Hr FOP wll hie a 
■ and UCE under its auspices in s is parallel mvntx&COT fik < 1 t 


(U ' TOUO) The Ltsl of approved subfiles includes bat is i 

• 1A - 1 A section exhibits 

* ACCOUNT - 1 A - case aeciit copies of s 

• ACCOUNTING case spent tracking of UCO c 

* ADMIN adnmustr stive items 
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SWA HI r/flfOFflKN 
(lJ)CminirTtni<mii IHibry tii uric 


* UK Financial analyst barking of UCO r *410 wli hues 

■ HR 1 A fiinjii ij .1 arulvtf «l|p«ial statements an d ropiest of cbecki 

* Cl unTsiifMt loti ntpeociimirs 

* DlSSl NilNAl mint (nation diuteitu rated outside llir FO 

* ELA ELSUR adnum&ti abvr 

* FLA l ELSUR otipmal lops 

* ELA I A ELSUR cofne* aid lops 

■ EIA IB ELSUR bmsrripts 

* ELA 3 consensual monitoring records 

* EOTEIJ’ROD imrstijdbVTr tnteUigener products 

* LEGAL OLA authorities AG euofdODi, policy public service nmxnKOh (PSA) 

* PEN p™ register report 

* RFT CHS reporting 

* STATS - ■aatisTuaJ accomplishments 


r.LV <1 FGtX)) Ti ansiftan to Face- to Fare Activities 



1W4. (I 1 ) inm.inua New Fi an? hist Opel atious 

(U FOUQ) The FO will work with CTTU, CTUC and NS LB to <h aft and submit a Group I UCO 
proposal for UCRC review using staodanbed NTN1 language In except! iooal drcumstaoccs 
and while awaiting UCO approv al an FO may operate as an SO of an existing FOP with CTTU 
and CTUC approval 

(U FQUO) In certain instances an FO may not have the resources to become an FOP hi those 
investigations an FO may request io be added as an SO under die pertinent FOP {refer to 
sufeactiot il? 7 5 ) 

P.L5. (U) luiriaiiiig an SO 

(U FOUO) FOs planning to inmate an SO musi coordinate with CTTL'. CTUC. and die pertinent 
FOP The requesting FO must have die approval of the management widun the office s CT and 
as appiopt late cyber program io v»oik under the auspices of the FOP This approval must be 
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hti Hi VrH* n 

(U) ( mnlrflmdim 1'*+* y f ,*» dr 


do< unvntod »n m Ef ' fna rrut I hr level of apfj irovai jr tfuurd may V drtrTrowW by dir 
rnarupfinml withm llir j fifties brig FO 

(fjWTOUO) The IT rntguMta ronrutwre from tor periifirrif FOP to nil m m Vl jarfer 
{iperautm If dir POP coonrt with dir request dir t mr aprni rrqpirtot vn 1/ dial OTC ami 
CTUC coordinate wttii NSI Jl to obtMiCll) apt vovaf fm (hr nrtinnun of (hr on* Vi Cfn <* 
CTUC rWumrnt* (mi approval m H funri* and nofe&r* dir W and FOP The PG unary w* 
cjjjci atinm until ofTir ial rtotifr ahori from CTTU or CTUC m lerirvcd 

1 1J .6, (II) I o trlligMir ¥ Di^foii jfwtn 

(UWPOUO) In order tn tossmtifutr mtrlbprn r to a fm&ffi pownmeti partner dir r«ia c* 
agent will draft ad \X‘ derived from (XI UCB, or CHS irportny nd rmrdnAr *4 tor r.a*r 
agent of the (elated ftvmtipbai The POP will review tor bf and roordtautir frub CJIT C ITU 
will obtain drvgjiaird mtrlligmre divrJoMue official fDJDOj ^prnvil and eocwfanie irtifc due 
I rjrai and the CIA as verified by appbc able MOUs to tosseraiaie the irddligew e 

(U//FOUO) Ihr preceding reqminTimr does not prevent the dBuennoaixB of turn rtrDigmce 
liifoimaiion or firuslied intelligence products with appropnalr rrripKmts m accordmte wd 
DItXf and established Oifrrtoialr of Intelligence i Df) potion AH tnfbnxaiaaa dm? mt be 
Appi opi tateJ y dot unir tiled on an FD 999 m accordance with tbr DfOG 

1 7.7.7. (U) Irn p^; (ig a five \\ grk flow 

(UWFOUO) 1 argrtinp requests or Irads from members of dir NTNI are ifflt to the UR? for 
review CTTU assigns tfar lead to tbr appropriate FOP or SO The FOP or SO ant fMBr that * 
proper PI or full investigation is open and the FOP sends die rcquestmg FQ m Et dooaroejnf 
its acceptance or rejection of the tatgrtmg request 

(U//FOUQ) For a lead that has been rejected the afoveiueudoned EC documesto the icasoafu far 
rejection For a lead thai lias lieen accepted the FOP assifgH this lead to the cwid Atstti far m 
appropriate OCT UCE or CHS 

• (U(/FOUO) The contact agent coordinates targeting msd imrUi pence dnuMM into 
the requesting FO documents acceptance of the lead an d prcr.vdes tor operatscoal 
targeting plan in an EC format 

* (U TOCO) The contort agent provides the requesting FO with jpdiirs rrf toe 
operational targeting tto a periodic basis This is documented in EC forms to the 
operational investigative file and appi opiute OCE, CCE. « OfS subfile 

(U TOCO) Intelligence winch includes but is not Lunated to efarlmes mtelfifeace aifismstni 
reports (OR), and cables, is forwarded to CTTU for uifotn^o^^purooH^AO coannwcalanm 
me hiding leads, are posted to the MTN1 un rsfasatue file -Ail OCE CCE and 

( H ^ornnmni^hon^e p>sird to tlie FOP s SO s assiened subfile under the NTTNI 
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SI c Ki lY/NOlORN 
(l 1)4 v m unci tom nisrn Muy tmufc 


17.7 S. (I T ) PipTfoiiuirt Measure* 

IT f g |. (l r ) StaliiHul At i ompVhments 

(IF/FOl IQ) IV contact agent is rrqmrrd to mwn all OCH T UCE, or CHS dDciimmlaluifi arid 
drift mi rr if and when investigative arcornpLishinnifc ran be claimed 1 V rontarl agent will 
claim statutes few ihr OCB. UCi CHS and fnt Inntsrlf or lirtwlf TV amunpU'dinirril'i aif 
posted to the FOPS STATS subfile the substantiur investigations subfile aid the NTNI 
investigataT file number, Si' ATS subfile 

(I ) Othei SUtisIkal Arrmtipli^hnM-uls 

1 1 I GUO) Under thf NTNI odin measures will l>c established to paug^toyj^njrtruwic^f 
OfT|MdUlT.s lliese will include nm-astiies sum la to V cmirm 
- ■[ restarted an ess] form s sUhsiiraJ ari ompliduiimts used fi n CHSs 

(S//IRTO USA. FVBY) Other specific online paiameteis aie also introduced, including the 
duration online, the number of posting made the extremist online venue identified (e g blog or 
Website) and onl me personas oealrd 

17.7.9. (U) Franchise Opetatiuii Accounting and Budget 

(Ij TOUO) Each FOP under NTNt assigns an FBI employee to act as the in vest i rail on 
accountant andot financial analyst That person is responsible for ensuring the FOP is compliant 
willi the guidance set forth in the Confidenti al Funding Polw Gutdfi (0JTB_PCf) 
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